WIP: Bazel template

WIP: use new MODULE.bazel system. WIP: use `.bazel` extension on BUILD files.
2024-05-13 10:56:08 +00:00
120 changed files with 1191 additions and 1146 deletions
--- a/.woodpecker/check.yml
+++ b/.woodpecker/check.yml
@ -7,7 +7,7 @@ steps:
  commands:
  - nix flake check

- name: notify
+- name: notifiy
  image: bash
  environment:
    ADDRESS:
--- a/flake.lock
+++ b/flake.lock
@ -14,11 +14,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1723293904,
-        "narHash": "sha256-b+uqzj+Wa6xgMS9aNbX4I+sXeb5biPDi39VgvSFqFvU=",
+        "lastModified": 1714136352,
+        "narHash": "sha256-BtWQ2Th/jamO1SlD+2ASSW5Jaf7JhA/JLpQHk0Goqpg=",
        "owner": "ryantm",
        "repo": "agenix",
-        "rev": "f6291c5935fdc4e0bef208cfc0dcab7e3f7a1c41",
+        "rev": "24a7ea390564ccd5b39b7884f597cfc8d7f6f44e",
        "type": "github"
      },
      "original": {
@ -73,11 +73,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1733312601,
-        "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
+        "lastModified": 1714641030,
+        "narHash": "sha256-yzcRNDoyVP7+SCNX0wmuDju1NUCt8Dz9+lyUXEI0dbI=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
+        "rev": "e5d10a24b66c3ea8f150e47dfdb0416ab7c3390e",
        "type": "github"
      },
      "original": {
@ -94,11 +94,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "lastModified": 1710146030,
+        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
        "owner": "numtide",
        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
        "type": "github"
      },
      "original": {
@ -136,11 +136,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1734808199,
-        "narHash": "sha256-MxlUcLjE8xLbrI1SJ2B2jftlg4wdutEILa3fgqwA98I=",
+        "lastModified": 1714679908,
+        "narHash": "sha256-KzcXzDvDJjX34en8f3Zimm396x6idbt+cu4tWDVS2FI=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "f342df3ad938f205a913973b832f52c12546aac6",
+        "rev": "9036fe9ef8e15a819fa76f47a8b1f287903fb848",
        "type": "github"
      },
      "original": {
@ -152,11 +152,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1734424634,
-        "narHash": "sha256-cHar1vqHOOyC7f1+tVycPoWTfKIaqkoe1Q6TnKzuti4=",
+        "lastModified": 1714635257,
+        "narHash": "sha256-4cPymbty65RvF1DWQfc+Bc8B233A1BWxJnNULJKQ1EY=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "d3c42f187194c26d9f0309a8ecc469d6c878ce33",
+        "rev": "63c3a29ca82437c87573e4c6919b09a24ea61b0f",
        "type": "github"
      },
      "original": {
@ -167,21 +167,12 @@
      }
    },
    "nur": {
-      "inputs": {
-        "flake-parts": [
-          "flake-parts"
-        ],
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "treefmt-nix": "treefmt-nix"
-      },
      "locked": {
-        "lastModified": 1734810357,
-        "narHash": "sha256-Oa6d+y1/PVaPrZ/GYwvmTK9kSrc5Qx/8D3DFN2TzpVA=",
+        "lastModified": 1714825428,
+        "narHash": "sha256-6U4cppyR0u6sqSSVr3GMrnIXhP2YGR0knfgrUGtr/1Y=",
        "owner": "nix-community",
        "repo": "NUR",
-        "rev": "e7b7b92a7c97a91f1465ab433bbdf6d00df1db8e",
+        "rev": "5847f3365c16afafc10c56994beadd4cdc8552ee",
        "type": "github"
      },
      "original": {
@ -194,6 +185,9 @@
    "pre-commit-hooks": {
      "inputs": {
        "flake-compat": "flake-compat",
+        "flake-utils": [
+          "futils"
+        ],
        "gitignore": "gitignore",
        "nixpkgs": [
          "nixpkgs"
@ -203,11 +197,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1734797603,
-        "narHash": "sha256-ulZN7ps8nBV31SE+dwkDvKIzvN6hroRY8sYOT0w+E28=",
+        "lastModified": 1714478972,
+        "narHash": "sha256-q//cgb52vv81uOuwz1LaXElp3XAe1TqrABXODAEF6Sk=",
        "owner": "cachix",
        "repo": "pre-commit-hooks.nix",
-        "rev": "f0f0dc4920a903c3e08f5bdb9246bb572fcae498",
+        "rev": "2849da033884f54822af194400f8dff435ada242",
        "type": "github"
      },
      "original": {
@ -244,27 +238,6 @@
        "repo": "default",
        "type": "github"
      }
-    },
-    "treefmt-nix": {
-      "inputs": {
-        "nixpkgs": [
-          "nur",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1733222881,
-        "narHash": "sha256-JIPcz1PrpXUCbaccEnrcUS8jjEb/1vJbZz5KkobyFdM=",
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "rev": "49717b5af6f80172275d47a418c9719a31a78b53",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "type": "github"
-      }
    }
  },
  "root": "root",
--- a/flake.nix
+++ b/flake.nix
@ -55,10 +55,6 @@
      owner = "nix-community";
      repo = "NUR";
      ref = "master";
-      inputs = {
-        flake-parts.follows = "flake-parts";
-        nixpkgs.follows = "nixpkgs";
-      };
    };

    pre-commit-hooks = {
@ -67,6 +63,7 @@
      repo = "pre-commit-hooks.nix";
      ref = "master";
      inputs = {
+        flake-utils.follows = "futils";
        nixpkgs.follows = "nixpkgs";
        nixpkgs-stable.follows = "nixpkgs";
      };
--- a/flake/home-manager.nix
+++ b/flake/home-manager.nix
@ -25,7 +25,7 @@ let
      inherit system;

      overlays = (lib.attrValues self.overlays) ++ [
-        inputs.nur.overlays.default
+        inputs.nur.overlay
      ];
    };

--- a/flake/nixos.nix
+++ b/flake/nixos.nix
@ -7,7 +7,7 @@ let
    }
    {
      nixpkgs.overlays = (lib.attrValues self.overlays) ++ [
-        inputs.nur.overlays.default
+        inputs.nur.overlay
      ];
    }
    # Include generic settings
--- a/hosts/nixos/porthos/secrets/acme/dns-key.age
+++ b/hosts/nixos/porthos/secrets/acme/dns-key.age
@ -1,9 +1,8 @@
 age-encryption.org/v1
-> ssh-ed25519 cKojmg Ec0xt1uJTva8MxUdoTVX5m3uWaIiRlodf345FEM7Uzs
-aJIneWFJPB5HVeoUGp57agXih9YeZ6xMEbyQ+zJtWQY
-> ssh-ed25519 jPowng B5XotRgv7s/FUegGhceBj7EoukewNUOIFl4TFRQf1EQ
-PgGCBd/Pqwp7ayqi7okHBGF1SfFpwT4KlHJ/np6p2uQ
--- AeLgwGz6k3OABb53cXNaCU/sgI4FlU1s6p8PhAaFOlg
-1ÌÉCÔ¹ð¤ŽULfI1¸Hm»Ûòb}m””îŸ¡ ÁÅ¡ìg•ß0¦¢–¤`X<16>G>\>¹8rŽz+Š›Y ™¼`—Ê¢.JBUÏ!zÂ¸Z50ú*õ¡ÙŸ¤×ÖÇ®I<C2AE>ôÔ]¹‹ÏåI
-Äµ<18>¿–oÒÛ°…g„®„ÒêÁ³Â¿Ÿt’©nƒºãcz[»{
-jçå&ÁõõNæ°Nÿo{õš½‚
-eP¾=L‰™
6¦.SP:»e¶–
+-> ssh-ed25519 cKojmg bQFr9oAnbo1rI/MpUV8wQz/Xj7iZY4ZU+Swf0nSIQFw
+zama2XJ0gdvUlD2GHMhmZqHSxHe+dKSfXnHoWDcSw7Y
+-> ssh-ed25519 jPowng gitUwSKTNKWLSxnwa185O7x/u0ul93g8wPESdZaKRk8
+uvBIfAUkZp5sg6rfeEGvL5ZDV8m2uSEotW02kjPN3Hw
+--- SZxe5f/CUZBvPQa2Sz/UBY3L68rMkIGGRuZPk7YE+Vg
+¾r ú&…¥‹{~v?¨}=Ä
+}+
¿SQ’M[²]Œ±kMÒAàtŒÃmMë/£µLsü|Þ…m©CÀñiYC}ƒŽ‡çxŽ€
--- a/hosts/nixos/porthos/secrets/matrix/sliding-sync-secret.age
+++ b/hosts/nixos/porthos/secrets/matrix/sliding-sync-secret.age
@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 cKojmg xRtF3XVc7yPicAV/E4U7mn0itvD0h1BWBTjwunuoe2E
+OkB9sjGB3ulH4Feuyj3Ed0DBG4+mghW/Qpum9oXL/8c
+-> ssh-ed25519 jPowng 1r8drqhz1yZdTq0Kvqya+ArU1C2fkN7Gg9LiWWfeUFg
+cjbxntVwHvqLaJpiKs/Y8ojeb6e3/cLFcsoeuoobfFg
+--- B1qA2PylJBrdZxZtCzlU2kRPvxLM+IrXTvR+ERxVtTY
+"W9<57>Äbg¸©~Ì/áÕb4ãÕ†ú³ÜÔIÊ
+Û}ð
§ËÅË-³²ªNó±”ÑC7vWœbºØ?¦8=œÉwÆBÃUpJClï²OÈ™³œnOÁ\
--- a/hosts/nixos/porthos/secrets/pdf-edit/login.age
+++ b/hosts/nixos/porthos/secrets/pdf-edit/login.age
@ -1,8 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 cKojmg VYlHgHSLpfKb5bn1XA3aCpfX7M23DgbraLxxOfo9PDk
-Rj+mDvAsWX3WwpuhTrOubmo17j/aud5+P87df5bosBA
-> ssh-ed25519 jPowng o9ZFaYrITZ6DjWw07Vk/+TkuU187/ytlEK4sw7G32G4
-zmxlpDvDDEgQFqBVARXeX1ABhvfJ4uAHfa6mIxXzjAY
--- k/d9FWW8/OSo8EllwOBV74pZyX918u54jEljGk3ATUc
-ü4+ø2{‘hE7!ÒGA`×<>_@Íß—´¡R_ý§6J„ñL4v,‚6%ô‡øó#^®	Ù¹
åB§OøF‚|’7Ü½ÉL]œÙjR¨
-BþóÛ¾éaòs]xS<78>Î	pbÞo#¬J1QŸ=t}5Õ>Oï‘{+¼.
M"7e»yý÷—
--- a/hosts/nixos/porthos/secrets/secrets.nix
+++ b/hosts/nixos/porthos/secrets/secrets.nix
@ -48,6 +48,9 @@ in
    owner = "matrix-synapse";
    publicKeys = all;
  };
+  "matrix/sliding-sync-secret.age" = {
+    publicKeys = all;
+  };

  "mealie/mail.age" = {
    publicKeys = all;
@ -74,24 +77,13 @@ in
  "paperless/password.age".publicKeys = all;
  "paperless/secret-key.age".publicKeys = all;

-  "pdf-edit/login.age".publicKeys = all;
-
  "podgrab/password.age".publicKeys = all;

  "pyload/credentials.age".publicKeys = all;

-  "sso/auth-key.age" = {
-    owner = "nginx-sso";
-    publicKeys = all;
-  };
-  "sso/ambroisie/password-hash.age" = {
-    owner = "nginx-sso";
-    publicKeys = all;
-  };
-  "sso/ambroisie/totp-secret.age" = {
-    owner = "nginx-sso";
-    publicKeys = all;
-  };
+  "sso/auth-key.age".publicKeys = all;
+  "sso/ambroisie/password-hash.age".publicKeys = all;
+  "sso/ambroisie/totp-secret.age".publicKeys = all;

  "tandoor-recipes/secret-key.age".publicKeys = all;

--- a/hosts/nixos/porthos/services.nix
+++ b/hosts/nixos/porthos/services.nix
@ -69,6 +69,9 @@ in
      mailConfigFile = secrets."matrix/mail".path;
      # Only necessary when doing the initial registration
      secretFile = secrets."matrix/secret".path;
+      slidingSync = {
+        secretFile = secrets."matrix/sliding-sync-secret".path;
+      };
    };
    mealie = {
      enable = true;
@ -95,9 +98,6 @@ in
    nextcloud = {
      enable = true;
      passwordFile = secrets."nextcloud/password".path;
-      collabora = {
-        enable = true;
-      };
    };
    nix-cache = {
      enable = true;
@ -127,10 +127,20 @@ in
      passwordFile = secrets."paperless/password".path;
      secretKeyFile = secrets."paperless/secret-key".path;
    };
-    # Sometimes, editing PDFs is useful
-    pdf-edit = {
+    # The whole *arr software suite
+    pirate = {
      enable = true;
-      loginFile = secrets."pdf-edit/login".path;
+      # ... But not Lidarr because I don't care for music that much
+      lidarr = {
+        enable = false;
+      };
+    };
+    # Podcast automatic downloader
+    podgrab = {
+      enable = true;
+      passwordFile = secrets."podgrab/password".path;
+      dataDir = "/data/media/podcasts";
+      port = 9598;
    };
    # Regular backups
    postgresql-backup.enable = true;
@ -142,16 +152,13 @@ in
    rss-bridge.enable = true;
    # Usenet client
    sabnzbd.enable = true;
-    # The whole *arr software suite
-    servarr = {
-      enable = true;
-      # ... But not Lidarr because I don't care for music that much
-      lidarr = {
-        enable = false;
-      };
-    };
-    # Because I still need to play sysadmin
+    # Because I stilll need to play sysadmin
    ssh-server.enable = true;
+    # Recipe manager
+    tandoor-recipes = {
+      enable = true;
+      secretKeyFile = secrets."tandoor-recipes/secret-key".path;
+    };
    # Torrent client and webui
    transmission = {
      enable = true;
--- a/modules/home/atuin/default.nix
+++ b/modules/home/atuin/default.nix
@ -1,19 +1,15 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, ... }:
 let
  cfg = config.my.home.atuin;
 in
 {
  options.my.home.atuin = with lib; {
    enable = my.mkDisableOption "atuin configuration";
-
-    # I want the full experience by default
-    package = mkPackageOption pkgs "atuin" { };
  };

  config = lib.mkIf cfg.enable {
    programs.atuin = {
      enable = true;
-      inherit (cfg) package;

      flags = [
        # I *despise* this hijacking of the up key, even though I use Ctrl-p
--- a/modules/home/calibre/default.nix
+++ b/modules/home/calibre/default.nix
@ -5,13 +5,11 @@ in
 {
  options.my.home.calibre = with lib; {
    enable = mkEnableOption "calibre configuration";
-
-    package = mkPackageOption pkgs "calibre" { };
  };

  config = lib.mkIf cfg.enable {
    home.packages = with pkgs; [
-      cfg.package
+      calibre
    ];
  };
 }
--- a/modules/home/direnv/lib/android.sh
+++ b/modules/home/direnv/lib/android.sh
@ -1,4 +1,4 @@
-# shellcheck shell=bash
+#shellcheck shell=bash

 # shellcheck disable=2155
 use_android() {
@ -32,16 +32,10 @@ use_android() {
            -b|--build-tools)
                build_tools_version="$2"
                shift 2
-                if ! [ -e "$ANDROID_HOME/build-tools/$build_tools_version" ]; then
-                    log_error "use_android: build-tools version '$build_tools_version' does not exist"
-                fi
                ;;
            -n|--ndk)
                ndk_version="$2"
                shift 2
-                if ! [ -e "$ANDROID_HOME/ndk/$ndk_version" ]; then
-                    log_error "use_android: NDK version '$ndk_version' does not exist"
-                fi
                ;;
            --)
                shift
--- a/modules/home/direnv/lib/nix.sh
+++ b/modules/home/direnv/lib/nix.sh
@ -1,4 +1,4 @@
-# shellcheck shell=bash
+#shellcheck shell=bash

 use_pkgs() {
    if ! has nix; then
--- a/modules/home/direnv/lib/postgres.sh
+++ b/modules/home/direnv/lib/postgres.sh
@ -1,4 +1,4 @@
-# shellcheck shell=bash
+#shellcheck shell=bash

 layout_postgres() {
    if ! has postgres || ! has initdb; then
--- a/modules/home/direnv/lib/python.sh
+++ b/modules/home/direnv/lib/python.sh
@ -1,4 +1,4 @@
-# shellcheck shell=bash
+#shellcheck shell=bash

 layout_poetry() {
    if ! has poetry; then
@ -9,12 +9,12 @@ layout_poetry() {

    if [[ ! -f pyproject.toml ]]; then
        # shellcheck disable=2016
-        log_error 'layout_poetry: no pyproject.toml found. Use `poetry init` to create one first'
+        log_error 'layout_poetry: no pyproject.toml found. Use `poetry new` or `poetry init` to create one first'
        return 1
    fi

    # create venv if it doesn't exist
-    poetry run -q -- true
+    poetry run true

    # shellcheck disable=2155
    export VIRTUAL_ENV=$(poetry env info --path)
@ -23,35 +23,3 @@ layout_poetry() {
    watch_file pyproject.toml
    watch_file poetry.lock
 }
-
-layout_uv() {
-    if ! has uv; then
-        # shellcheck disable=2016
-        log_error 'layout_uv: `uv` is not in PATH'
-        return 1
-    fi
-
-    if [[ ! -f pyproject.toml ]]; then
-        # shellcheck disable=2016
-        log_error 'layout_uv: no pyproject.toml found. Use `uv init` to create one first'
-        return 1
-    fi
-
-    local default_venv="$PWD/.venv"
-    : "${VIRTUAL_ENV:=$default_venv}"
-
-    # Use non-default venv path if required
-    if [ "$VIRTUAL_ENV" != "$default_venv" ]; then
-        export UV_PROJECT_ENVIRONMENT="$VIRTUAL_ENV"
-    fi
-
-    # create venv if it doesn't exist
-    uv venv -q
-
-    export VIRTUAL_ENV
-    export UV_ACTIVE=1
-    PATH_add "$VIRTUAL_ENV/bin"
-    watch_file pyproject.toml
-    watch_file uv.lock
-    watch_file .python-version
-}
--- a/modules/home/discord/default.nix
+++ b/modules/home/discord/default.nix
@ -7,13 +7,11 @@ in
 {
  options.my.home.discord = with lib; {
    enable = mkEnableOption "discord configuration";
-
-    package = mkPackageOption pkgs "discord" { };
  };

  config = lib.mkIf cfg.enable {
    home.packages = with pkgs; [
-      cfg.package
+      discord
    ];

    xdg.configFile."discord/settings.json".source =
--- a/modules/home/firefox/tridactyl/tridactylrc
+++ b/modules/home/firefox/tridactyl/tridactylrc
@ -4,7 +4,7 @@
 " Use dark color scheme
 colorscheme dark

-" Make tridactyl open Vim in my preferred terminal
+" Make tridactyl open Vim in my prefered terminal
 set editorcmd @editorcmd@

 " Remove editor file after use
@ -15,8 +15,8 @@ bind --mode=input <C-i> editor_rm

 " Binds {{{
 " Reddit et al. {{{
-" Toggle comments on Reddit, Hacker News, Lobste.rs, LWN
-bind ;c hint -Jc [class*="expand"],[class*="togg"],[class="comment_folder"],[class="CommentTitle"]
+" Toggle comments on Reddit, Hacker News, Lobste.rs
+bind ;c hint -Jc [class*="expand"],[class*="togg"],[class="comment_folder"]

 " Make `gu` take me back to subreddit from comments
 bindurl reddit.com gu urlparent 3
@ -26,8 +26,8 @@ bindurl www.google.com f hint -Jc #search a
 bindurl www.google.com F hint -Jbc #search a

 " Only hint search results on DuckDuckGo
-bindurl ^https://duckduckgo.com f hint -Jc [data-testid="result"]
-bindurl ^https://duckduckgo.com F hint -Jbc [data-testid="result"]
+bindurl ^https://duckduckgo.com f hint -Jc [data-testid="result-title-a"]
+bindurl ^https://duckduckgo.com F hint -Jbc [data-testid="result-title-a"]

 " Only hint item pages on Hacker News
 bindurl news.ycombinator.com ;f hint -Jc .age > a
--- a/modules/home/gdb/default.nix
+++ b/modules/home/gdb/default.nix
@ -6,28 +6,33 @@ in
  options.my.home.gdb = with lib; {
    enable = my.mkDisableOption "gdb configuration";

-    package = mkPackageOption pkgs "gdb" { };
-
    rr = {
      enable = my.mkDisableOption "rr configuration";

-      package = mkPackageOption pkgs "rr" { };
+      package = mkOption {
+        type = types.package;
+        default = pkgs.rr;
+        defaultText = literalExample "pkgs.rr";
+        description = ''
+          Package providing rr
+        '';
+      };
    };
  };

  config = lib.mkIf cfg.enable (lib.mkMerge [
    {
      home.packages = with pkgs; [
-        cfg.package
+        gdb
      ];

      xdg = {
        configFile."gdb/gdbinit".source = ./gdbinit;
-        stateFile."gdb/.keep".text = "";
+        dataFile. "gdb/.keep".text = "";
      };

      home.sessionVariables = {
-        GDBHISTFILE = "${config.xdg.stateHome}/gdb/gdb_history";
+        GDBHISTFILE = "${config.xdg.dataHome}/gdb/gdb_history";
      };
    }

--- a/modules/home/gtk/default.nix
+++ b/modules/home/gtk/default.nix
@ -21,12 +21,12 @@ in
    };

    iconTheme = {
-      package = pkgs.gnome-themes-extra;
+      package = pkgs.gnome.gnome-themes-extra;
      name = "Adwaita";
    };

    theme = {
-      package = pkgs.gnome-themes-extra;
+      package = pkgs.gnome.gnome-themes-extra;
      name = "Adwaita";
    };
  };
--- a/modules/home/mail/accounts/default.nix
+++ b/modules/home/mail/accounts/default.nix
@ -58,7 +58,7 @@ in
 {
  config.accounts.email.accounts = {
    personal = lib.mkMerge [
-      # Common configuration
+      # Common configuraton
      (mkConfig {
        domain = "belanyi.fr";
        address = "bruno";
@ -70,7 +70,7 @@ in
    ];

    gmail = lib.mkMerge [
-      # Common configuration
+      # Common configuraton
      (mkConfig {
        domain = "gmail.com";
        address = "brunobelanyi";
--- a/modules/home/nix/default.nix
+++ b/modules/home/nix/default.nix
@ -22,16 +22,12 @@ in
  options.my.home.nix = with lib; {
    enable = my.mkDisableOption "nix configuration";

-    gc = {
-      enable = my.mkDisableOption "nix GC configuration";
-    };
-
    cache = {
      selfHosted = my.mkDisableOption "self-hosted cache";
    };

    inputs = {
-      link = my.mkDisableOption "link inputs to `$XDG_CONFIG_HOME/nix/inputs/`";
+      link = my.mkDisableOption "link inputs to `/etc/nix/inputs/`";

      addToRegistry = my.mkDisableOption "add inputs and self to registry";

@ -64,22 +60,6 @@ in
      };
    }

-    (lib.mkIf cfg.gc.enable {
-      nix.gc = {
-        automatic = true;
-
-        # Every week, with some wiggle room
-        frequency = "weekly";
-        randomizedDelaySec = "10min";
-
-        # Use a persistent timer for e.g: laptops
-        persistent = true;
-
-        # Delete old profiles automatically after 15 days
-        options = "--delete-older-than 15d";
-      };
-    })
-
    (lib.mkIf cfg.cache.selfHosted {
      nix = {
        settings = {
@ -116,7 +96,7 @@ in
    })

    (lib.mkIf cfg.inputs.addToNixPath {
-      nix.nixPath = [ "${config.xdg.configHome}/nix/inputs" ];
+      home.sessionVariables.NIX_PATH = "${config.xdg.configHome}/nix/inputs\${NIX_PATH:+:$NIX_PATH}";
    })
  ]);
 }
--- a/modules/home/packages/default.nix
+++ b/modules/home/packages/default.nix
@ -26,7 +26,6 @@ in
      fd
      file
      ripgrep
-      tree
    ] ++ cfg.additionalPackages);

    nixpkgs.config = {
--- a/modules/home/pager/default.nix
+++ b/modules/home/pager/default.nix
@ -15,7 +15,7 @@ in
      # Clear the screen on start and exit
      LESS = "-R -+X -c";
      # Better XDG compliance
-      LESSHISTFILE = "${config.xdg.stateHome}/less/history";
+      LESSHISTFILE = "${config.xdg.dataHome}/less/history";
      LESSKEY = "${config.xdg.configHome}/less/lesskey";
    };
  };
--- a/modules/home/tmux/default.nix
+++ b/modules/home/tmux/default.nix
@ -30,7 +30,7 @@ in
      });

      default = { ${config.my.home.terminal.program} = { }; };
-      defaultText = literalExpression ''
+      defaultText = litteralExpression ''
        { ''${config.my.home.terminal.program} = { }; };
      '';
      example = { xterm-256color = { }; };
@ -47,8 +47,6 @@ in
    clock24 = true; # I'm one of those heathens
    escapeTime = 0; # Let vim do its thing instead
    historyLimit = 100000; # Bigger buffer
-    mouse = false; # I dislike mouse support
-    focusEvents = true; # Report focus events
    terminal = "tmux-256color"; # I want accurate termcap info

    plugins = with pkgs.tmuxPlugins; [
@ -82,13 +80,6 @@ in
    ];

    extraConfig = ''
-      # Refresh configuration
-      bind-key -N "Source tmux.conf" R source-file ${config.xdg.configHome}/tmux/tmux.conf \; display-message "Sourced tmux.conf!"
-
-      # Accept sloppy Ctrl key when switching windows, on top of default mapping
-      bind-key -N "Select the previous window" C-p previous-window
-      bind-key -N "Select the next window" C-n next-window
-
      # Better vim mode
      bind-key -T copy-mode-vi 'v' send -X begin-selection
      ${
--- a/modules/home/vim/after/ftplugin/bp.vim
+++ b/modules/home/vim/after/ftplugin/bp.vim
@ -0,0 +1,7 @@
+" Create the `b:undo_ftplugin` variable if it doesn't exist
+call ftplugined#check_undo_ft()
+
+" Add comment format
+setlocal comments=b://,s1:/*,mb:*,ex:*/
+setlocal commentstring=//\ %s
+let b:undo_ftplugin.='|setlocal comments< commentstring<'
--- a/modules/home/vim/after/ftplugin/netrw.vim
+++ b/modules/home/vim/after/ftplugin/netrw.vim
@ -0,0 +1,6 @@
+" Create the `b:undo_ftplugin` variable if it doesn't exist
+call ftplugined#check_undo_ft()
+
+" Don't show Netrw in buffer list
+setlocal bufhidden=delete
+let b:undo_ftplugin='|setlocal bufhidden<'
--- a/modules/home/vim/after/plugin/mappings/commentary.lua
+++ b/modules/home/vim/after/plugin/mappings/commentary.lua
@ -0,0 +1,10 @@
+local wk = require("which-key")
+
+local keys = {
+    name = "Comment/uncomment",
+    c = "Current line",
+    u = "Uncomment the current and adjacent commented lines",
+    ["gc"] = "Uncomment the current and adjacent commented lines",
+}
+
+wk.register(keys, { prefix = "gc" })
--- a/modules/home/vim/after/plugin/mappings/misc.lua
+++ b/modules/home/vim/after/plugin/mappings/misc.lua
@ -0,0 +1,7 @@
+local wk = require("which-key")
+
+local keys = {
+    ["<leader>"] = { "<cmd>nohls<CR>", "Clear search highlight" },
+}
+
+wk.register(keys, { prefix = "<leader>" })
--- a/modules/home/vim/after/plugin/mappings/telescope.lua
+++ b/modules/home/vim/after/plugin/mappings/telescope.lua
@ -0,0 +1,15 @@
+local wk = require("which-key")
+local telescope_builtin = require("telescope.builtin")
+
+local keys = {
+    f = {
+        name = "Fuzzy finder",
+        b = { telescope_builtin.buffers, "Open buffers" },
+        f = { telescope_builtin.git_files, "Git tracked files" },
+        F = { telescope_builtin.find_files, "Files" },
+        g = { telescope_builtin.live_grep, "Grep string" },
+        G = { telescope_builtin.grep_string, "Grep string under cursor" },
+    },
+}
+
+wk.register(keys, { prefix = "<leader>" })
--- a/modules/home/vim/after/plugin/mappings/tree-sitter-textobjects.lua
+++ b/modules/home/vim/after/plugin/mappings/tree-sitter-textobjects.lua
@ -0,0 +1,30 @@
+local wk = require("which-key")
+
+local motions = {
+    ["]m"] = "Next method start",
+    ["]M"] = "Next method end",
+    ["]S"] = "Next statement start",
+    ["]]"] = "Next class start",
+    ["]["] = "Next class end",
+    ["[m"] = "Previous method start",
+    ["[M"] = "Previous method end",
+    ["[S"] = "Previous statement start",
+    ["[["] = "Previous class start",
+    ["[]"] = "Previous class end",
+}
+
+local objects = {
+    ["aa"] = "a parameter",
+    ["ia"] = "inner parameter",
+    ["ab"] = "a block",
+    ["ib"] = "inner block",
+    ["ac"] = "a class",
+    ["ic"] = "inner class",
+    ["af"] = "a function",
+    ["if"] = "inner function",
+    ["ak"] = "a comment",
+    ["aS"] = "a statement",
+}
+
+wk.register(motions, { mode = "n" })
+wk.register(objects, { mode = "o" })
--- a/modules/home/vim/after/plugin/mappings/unimpaired.lua
+++ b/modules/home/vim/after/plugin/mappings/unimpaired.lua
@ -3,124 +3,126 @@ local wk = require("which-key")
 local lsp = require("ambroisie.lsp")

 local keys = {
-    -- Previous
-    { "[", group = "Previous" },
-    -- Edition and navigation mappings
-    { "[<space>", desc = "Insert blank line above" },
-    { "[<C-L>", desc = "Previous location list file" },
-    { "[<C-Q>", desc = "Previous quickfix list file" },
-    { "[<C-T>", desc = "Previous tag in preview window" },
-    { "[a", desc = "Previous argument" },
-    { "[A", desc = "First argument" },
-    { "[b", desc = "Previous buffer" },
-    { "[B", desc = "First buffer" },
-    { "[e", desc = "Exchange previous line" },
-    { "[f", desc = "Previous file in directory" },
-    { "[l", desc = "Previous location list entry" },
-    { "[L", desc = "First Location list entry" },
-    { "[n", desc = "Previous conflict marker/diff hunk" },
-    { "[p", desc = "Paste line above" },
-    { "[P", desc = "Paste line above" },
-    { "[q", desc = "Previous quickfix list entry" },
-    { "[Q", desc = "First quickfix list entry" },
-    { "[t", desc = "Previous matching tag" },
-    { "[T", desc = "First matching tag" },
-    { "[z", desc = "Previous fold" },
-    -- Encoding
-    { "[C", desc = "C string encode" },
-    { "[u", desc = "URL encode" },
-    { "[x", desc = "XML encode" },
-    { "[y", desc = "C string encode" },
-    -- Custom
-    { "[d", lsp.goto_prev_diagnostic, desc = "Previous diagnostic" },
+    -- Edition and navigation mappins
+    ["["] = {
+        name = "Previous",
+        ["<space>"] = "Insert blank line above",
+        ["<C-L>"] = "Previous location list file",
+        ["<C-Q>"] = "Previous quickfix list file",
+        ["<C-T>"] = "Previous tag in preview window",
+        a = "Previous argument",
+        A = "First argument",
+        b = "Previous buffer",
+        B = "First buffer",
+        e = "Exchange previous line",
+        f = "Previous file in directory",
+        l = "Previous location list entry",
+        L = "First Location list entry",
+        n = "Previous conflict marker/diff hunk",
+        p = "Paste line above",
+        P = "Paste line above",
+        q = "Previous quickfix list entry",
+        Q = "First quickfix list entry",
+        t = "Previous matching tag",
+        T = "First matching tag",
+        z = "Previous fold",
+        -- Encoding
+        C = "C string encode",
+        u = "URL encode",
+        x = "XML encode",
+        y = "C string encode",
+        -- Custom
+        d = { lsp.goto_prev_diagnostic, "Previous diagnostic" },
+    },
+    ["]"] = {
+        name = "Next",
+        ["<space>"] = "Insert blank line below",
+        ["<C-L>"] = "Next location list file",
+        ["<C-Q>"] = "Next quickfix list file",
+        ["<C-T>"] = "Next tag in preview window",
+        a = "Next argument",
+        A = "Last argument",
+        b = "Next buffer",
+        B = "Last buffer",
+        e = "Exchange next line",
+        f = "Next file in directory",
+        l = "Next location list entry",
+        L = "Last Location list entry",
+        n = "Next conflict marker/diff hunk",
+        p = "Paste line below",
+        P = "Paste line below",
+        q = "Next quickfix list entry",
+        Q = "Last quickfix list entry",
+        t = "Next matching tag",
+        T = "Last matching tag",
+        z = "Next fold",
+        -- Decoding
+        C = "C string decode",
+        u = "URL decode",
+        x = "XML decode",
+        y = "C string decode",
+        -- Custom
+        d = { lsp.goto_next_diagnostic, "Next diagnostic" },
+    },

-    -- Next
-    { "]", group = "Next" },
-    -- Edition and navigation mappings
-    { "]<space>", desc = "Insert blank line below" },
-    { "]<C-L>", desc = "Next location list file" },
-    { "]<C-Q>", desc = "Next quickfix list file" },
-    { "]<C-T>", desc = "Next tag in preview window" },
-    { "]a", desc = "Next argument" },
-    { "]A", desc = "Last argument" },
-    { "]b", desc = "Next buffer" },
-    { "]B", desc = "Last buffer" },
-    { "]e", desc = "Exchange next line" },
-    { "]f", desc = "Next file in directory" },
-    { "]l", desc = "Next location list entry" },
-    { "]L", desc = "Last Location list entry" },
-    { "]n", desc = "Next conflict marker/diff hunk" },
-    { "]p", desc = "Paste line below" },
-    { "]P", desc = "Paste line below" },
-    { "]q", desc = "Next quickfix list entry" },
-    { "]Q", desc = "Last quickfix list entry" },
-    { "]t", desc = "Next matching tag" },
-    { "]T", desc = "Last matching tag" },
-    { "]z", desc = "Next fold" },
-    -- Decoding
-    { "]C", desc = "C string decode" },
-    { "]u", desc = "URL decode" },
-    { "]x", desc = "XML decode" },
-    { "]y", desc = "C string decode" },
-    -- Custom
-    { "]d", lsp.goto_next_diagnostic, desc = "Next diagnostic" },
-
-    -- Enable option
-    { "[o", group = "Enable option" },
-    { "[ob", desc = "Light background" },
-    { "[oc", desc = "Cursor line" },
-    { "[od", desc = "Diff" },
-    { "[of", "<cmd>FormatEnable<CR>", desc = "LSP Formatting" },
-    { "[oh", desc = "Search high-lighting" },
-    { "[oi", desc = "Case insensitive search" },
-    { "[ol", desc = "List mode" },
-    { "[on", desc = "Line numbers" },
-    { "[or", desc = "Relative line numbers" },
-    { "[op", "<cmd>lwindow<CR>", desc = "Location list" },
-    { "[oq", "<cmd>cwindow<CR>", desc = "Quickfix list" },
-    { "[ou", desc = "Cursor column" },
-    { "[ov", desc = "Virtual editing" },
-    { "[ow", desc = "Text wrapping" },
-    { "[ox", desc = "Cursor line and column" },
-    { "[oz", desc = "Spell checking" },
-
-    -- Disable option
-    { "]o", group = "Disable option" },
-    { "]ob", desc = "Light background" },
-    { "]oc", desc = "Cursor line" },
-    { "]od", desc = "Diff" },
-    { "]of", "<cmd>FormatDisable<CR>", desc = "LSP Formatting" },
-    { "]oh", desc = "Search high-lighting" },
-    { "]oi", desc = "Case insensitive search" },
-    { "]ol", desc = "List mode" },
-    { "]on", desc = "Line numbers" },
-    { "]op", "<cmd>lclose<CR>", desc = "Location list" },
-    { "]oq", "<cmd>cclose<CR>", desc = "Quickfix list" },
-    { "]or", desc = "Relative line numbers" },
-    { "]ou", desc = "Cursor column" },
-    { "]ov", desc = "Virtual editing" },
-    { "]ow", desc = "Text wrapping" },
-    { "]ox", desc = "Cursor line and column" },
-    { "]oz", desc = "Spell checking" },
-
-    -- Toggle option
-    { "yo", group = "Toggle option" },
-    { "yob", desc = "Light background" },
-    { "yoc", desc = "Cursor line" },
-    { "yod", desc = "Diff" },
-    { "yof", "<cmd>FormatToggle<CR>", desc = "LSP Formatting" },
-    { "yoh", desc = "Search high-lighting" },
-    { "yoi", desc = "Case insensitive search" },
-    { "yol", desc = "List mode" },
-    { "yon", desc = "Line numbers" },
-    { "yop", "<Plug>(qf_loc_toggle)", desc = "Location list" },
-    { "yoq", "<Plug>(qf_qf_toggle)", desc = "Quickfix list" },
-    { "yor", desc = "Relative line numbers" },
-    { "you", desc = "Cursor column" },
-    { "yov", desc = "Virtual editing" },
-    { "yow", desc = "Text wrapping" },
-    { "yox", desc = "Cursor line and column" },
-    { "yoz", desc = "Spell checking" },
+    -- Option mappings
+    ["[o"] = {
+        name = "Enable option",
+        b = "Light background",
+        c = "Cursor line",
+        d = "Diff",
+        f = { "<cmd>FormatEnable<CR>", "LSP Formatting" },
+        h = "Search high-lighting",
+        i = "Case insensitive search",
+        l = "List mode",
+        n = "Line numbers",
+        r = "Relative line numbers",
+        p = { "<cmd>lwindow<CR>", "Location list" },
+        q = { "<cmd>cwindow<CR>", "Quickfix list" },
+        u = "Cursor column",
+        v = "Virtual editing",
+        w = "Text wrapping",
+        x = "Cursor line and column",
+        z = "Spell checking",
+    },
+    ["]o"] = {
+        name = "Option off",
+        b = "Light background",
+        c = "Cursor line",
+        d = "Diff",
+        f = { "<cmd>FormatDisable<CR>", "LSP Formatting" },
+        h = "Search high-lighting",
+        i = "Case insensitive search",
+        l = "List mode",
+        n = "Line numbers",
+        p = { "<cmd>lclose<CR>", "Location list" },
+        q = { "<cmd>cclose<CR>", "Quickfix list" },
+        r = "Relative line numbers",
+        u = "Cursor column",
+        v = "Virtual editing",
+        w = "Text wrapping",
+        x = "Cursor line and column",
+        z = "Spell checking",
+    },
+    ["yo"] = {
+        name = "Option toggle",
+        b = "Light background",
+        c = "Cursor line",
+        d = "Diff",
+        f = { "<cmd>FormatToggle<CR>", "LSP Formatting" },
+        h = "Search high-lighting",
+        i = "Case insensitive search",
+        l = "List mode",
+        n = "Line numbers",
+        p = { "<Plug>(qf_loc_toggle)", "Location list" },
+        q = { "<Plug>(qf_qf_toggle)", "Quickfix list" },
+        r = "Relative line numbers",
+        u = "Cursor column",
+        v = "Virtual editing",
+        w = "Text wrapping",
+        x = "Cursor line and column",
+        z = "Spell checking",
+    },
 }

-wk.add(keys)
+wk.register(keys)
--- a/modules/home/vim/after/queries/diff/highlights.scm
+++ b/modules/home/vim/after/queries/diff/highlights.scm
@ -1,5 +0,0 @@
-; extends
-
-; I want to the line added/removed markers to be the correct color
-"+" @diff.plus
-"-" @diff.minus
--- a/modules/home/vim/default.nix
+++ b/modules/home/vim/default.nix
@ -40,18 +40,25 @@ in
      lualine-lsp-progress # Show progress for LSP servers

      # tpope essentials
+      vim-commentary # Easy comments
      vim-eunuch # UNIX integrations
      vim-fugitive # A 'git' wrapper
      vim-git # Sane git syntax files
      vim-repeat # Enanche '.' for plugins
      vim-rsi # Readline mappings
      vim-unimpaired # Some ex command mappings
+      vim-vinegar # Better netrw

      # Languages
+      rust-vim
      vim-beancount
+      vim-jsonnet
+      vim-nix
+      vim-toml

      # General enhancements
      vim-qf # Better quick-fix list
+      nvim-osc52 # Send clipboard data through terminal escape for SSH

      # Other wrappers
      git-messenger-vim # A simple blame window
@ -63,6 +70,7 @@ in
      none-ls-nvim # LSP integration for linters and formatters
      nvim-treesitter.withAllGrammars # Better highlighting
      nvim-treesitter-textobjects # More textobjects
+      nvim-ts-context-commentstring # Comment string in nested language blocks
      plenary-nvim # 'null-ls', 'telescope' dependency

      # Completion
@ -80,7 +88,6 @@ in
      dressing-nvim # Integrate native UI hooks with Telescope etc...
      gitsigns-nvim # Fast git UI integration
      nvim-surround # Deal with pairs, now in Lua
-      oil-nvim # Better alternative to NetrW
      telescope-fzf-native-nvim # Use 'fzf' fuzzy matching algorithm
      telescope-lsp-handlers-nvim # Use 'telescope' for various LSP actions
      telescope-nvim # Fuzzy finder interface
@ -98,11 +105,8 @@ in
      nixpkgs-fmt

      # Shell
-      bash-language-server
+      nodePackages.bash-language-server
      shfmt
-
-      # Generic
-      typos-lsp
    ];
  };

--- a/modules/home/vim/ftdetect/blueprint.lua
+++ b/modules/home/vim/ftdetect/blueprint.lua
@ -0,0 +1,6 @@
+-- Use `bp` filetype for Blueprint files
+vim.filetype.add({
+    extension = {
+        bp = "bp",
+    },
+})
--- a/modules/home/vim/ftdetect/gn.lua
+++ b/modules/home/vim/ftdetect/gn.lua
@ -0,0 +1,7 @@
+-- Use GN filetype for Chromium Generate Ninja files
+vim.filetype.add({
+    extension = {
+        gn = "gn",
+        gni = "gn",
+    },
+})
--- a/modules/home/vim/ftdetect/kbuild.lua
+++ b/modules/home/vim/ftdetect/kbuild.lua
@ -0,0 +1,6 @@
+-- Kbuild is just a Makefile under a different name
+vim.filetype.add({
+    filename = {
+        ["Kbuild"] = "make",
+    },
+})
--- a/modules/home/vim/ftdetect/tikz.lua
+++ b/modules/home/vim/ftdetect/tikz.lua
@ -0,0 +1,6 @@
+-- Use LaTeX filetype for TikZ files
+vim.filetype.add({
+    extension = {
+        tikz = "tex",
+    },
+})
--- a/modules/home/vim/init.vim
+++ b/modules/home/vim/init.vim
@ -1,4 +1,4 @@
-" Basic configuration {{{
+" Basic configuraion {{{
 """""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
 " Use UTF-8
 set encoding=utf-8
@ -38,10 +38,10 @@ set tabstop=8

 " File parameters {{{
 """""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
-" Disable swap files
+" Disable backups, we have source control for that
+set nobackup
+" Disable swapfiles too
 set noswapfile
-" Enable undo files
-set undofile
 " }}}

 " UI and UX parameters {{{
@ -86,6 +86,8 @@ set mouse=
 " Set dark mode by default
 set background=dark

+" 24 bit colors
+set termguicolors
 " Setup some overrides for gruvbox
 lua << EOF
 local gruvbox = require("gruvbox")
@ -100,13 +102,7 @@ gruvbox.setup({
        DiffChange = { fg = colors.aqua, bg = "NONE" },
        DiffDelete = { fg = colors.red, bg = "NONE" },
        DiffText = { fg = colors.yellow, bg = colors.bg0 },
-        -- Directories "pop" better in blue
-        Directory = { link = "GruvboxBlueBold" },
-    },
-    italic = {
-        -- Comments should not be italic, for e.g: box drawing
-        comments = false,
-    },
+    }
 })
 EOF
 " Use my preferred colorscheme
--- a/modules/home/vim/lua/ambroisie/lsp.lua
+++ b/modules/home/vim/lua/ambroisie/lsp.lua
@ -5,7 +5,7 @@ local lsp_format = require("lsp-format")

 --- Move to the next/previous diagnostic, automatically showing the diagnostics
 --- float if necessary.
--- @param forward bool whether to go forward or backwards
+--- @param forward whether to go forward or backwards
 local function goto_diagnostic(forward)
    vim.validate({
        forward = { forward, "boolean" },
@ -42,7 +42,7 @@ end

 --- shared LSP configuration callback
 --- @param client native client configuration
--- @param bufnr int? buffer number of the attached client
+--- @param bufnr int? buffer number of the attched client
 M.on_attach = function(client, bufnr)
    -- Format on save
    lsp_format.on_attach(client, bufnr)
@ -87,30 +87,31 @@ M.on_attach = function(client, bufnr)
    end

    local keys = {
-        buffer = bufnr,
-        -- LSP navigation
-        { "K", vim.lsp.buf.hover, desc = "Show symbol information" },
-        { "<C-k>", vim.lsp.buf.signature_help, desc = "Show signature information" },
-        { "gd", vim.lsp.buf.definition, desc = "Go to definition" },
-        { "gD", vim.lsp.buf.declaration, desc = "Go to declaration" },
-        { "gi", vim.lsp.buf.implementation, desc = "Go to implementation" },
-        { "gr", vim.lsp.buf.references, desc = "List all references" },
-        -- Code
-        { "<leader>c", group = "Code" },
-        { "<leader>ca", vim.lsp.buf.code_action, desc = "Code actions" },
-        { "<leader>cd", cycle_diagnostics_display, desc = "Cycle diagnostics display" },
-        { "<leader>cD", show_buffer_diagnostics, desc = "Show buffer diagnostics" },
-        { "<leader>cr", vim.lsp.buf.rename, desc = "Rename symbol" },
-        { "<leader>cs", vim.lsp.buf.signature_help, desc = "Show signature" },
-        { "<leader>ct", vim.lsp.buf.type_definition, desc = "Go to type definition" },
-        -- Workspace
-        { "<leader>cw", group = "Workspace" },
-        { "<leader>cwa", vim.lsp.buf.add_workspace_folder, desc = "Add folder to workspace" },
-        { "<leader>cwl", list_workspace_folders, desc = "List folders in workspace" },
-        { "<leader>cwr", vim.lsp.buf.remove_workspace_folder, desc = "Remove folder from workspace" },
+        K = { vim.lsp.buf.hover, "Show symbol information" },
+        ["<C-k>"] = { vim.lsp.buf.signature_help, "Show signature information" },
+        ["gd"] = { vim.lsp.buf.definition, "Go to definition" },
+        ["gD"] = { vim.lsp.buf.declaration, "Go to declaration" },
+        ["gi"] = { vim.lsp.buf.implementation, "Go to implementation" },
+        ["gr"] = { vim.lsp.buf.references, "List all references" },
+
+        ["<leader>c"] = {
+            name = "Code",
+            a = { vim.lsp.buf.code_action, "Code actions" },
+            d = { cycle_diagnostics_display, "Cycle diagnostics display" },
+            D = { show_buffer_diagnostics, "Show buffer diagnostics" },
+            r = { vim.lsp.buf.rename, "Rename symbol" },
+            s = { vim.lsp.buf.signature_help, "Show signature" },
+            t = { vim.lsp.buf.type_definition, "Go to type definition" },
+            w = {
+                name = "Workspace",
+                a = { vim.lsp.buf.add_workspace_folder, "Add folder to workspace" },
+                l = { list_workspace_folders, "List folders in workspace" },
+                r = { vim.lsp.buf.remove_workspace_folder, "Remove folder from workspace" },
+            },
+        },
    }

-    wk.add(keys)
+    wk.register(keys, { buffer = bufnr })
 end

 return M
--- a/modules/home/vim/lua/ambroisie/utils.lua
+++ b/modules/home/vim/lua/ambroisie/utils.lua
@ -48,22 +48,4 @@ M.list_lsp_clients = function(bufnr)
    return names
 end

--- partially apply a function with given arguments
-M.partial = function(f, ...)
-    local a = { ... }
-    local a_len = select("#", ...)
-
-    return function(...)
-        local tmp = { ... }
-        local tmp_len = select("#", ...)
-
-        -- Merge arg lists
-        for i = 1, tmp_len do
-            a[a_len + i] = tmp[i]
-        end
-
-        return f(unpack(a, 1, a_len + tmp_len))
-    end
-end
-
 return M
--- a/modules/home/vim/plugin/numbertoggle.lua
+++ b/modules/home/vim/plugin/numbertoggle.lua
@ -7,28 +7,17 @@ local numbertoggle = vim.api.nvim_create_augroup("numbertoggle", { clear = true
 vim.api.nvim_create_autocmd({ "BufEnter", "FocusGained", "InsertLeave", "WinEnter" }, {
    pattern = "*",
    group = numbertoggle,
-    callback = function()
-        if vim.opt.number:get() then
-            vim.opt.relativenumber = true
-        end
-    end,
+    command = "if &nu | setlocal rnu | endif",
 })
 vim.api.nvim_create_autocmd({ "BufLeave", "FocusLost", "InsertEnter", "WinLeave" }, {
    pattern = "*",
    group = numbertoggle,
-    callback = function()
-        if vim.opt.number:get() then
-            vim.opt.relativenumber = false
-        end
-    end,
+    command = "if &nu | setlocal nornu | endif",
 })

 -- Never show the sign column in a terminal buffer
 vim.api.nvim_create_autocmd({ "TermOpen" }, {
    pattern = "*",
    group = numbertoggle,
-    callback = function()
-        vim.opt.number = false
-        vim.opt.relativenumber = false
-    end,
+    command = "setlocal nonu nornu",
 })
--- a/modules/home/vim/plugin/settings/git.lua
+++ b/modules/home/vim/plugin/settings/git.lua
@ -1,75 +1,58 @@
 local gitsigns = require("gitsigns")
-local utils = require("ambroisie.utils")
 local wk = require("which-key")

--- Transform `f` into a function which acts on the current visual selection
-local function make_visual(f)
-    return function()
-        local first = vim.fn.line("v")
-        local last = vim.fn.line(".")
-        f({ first, last })
-    end
-end
-
-local function nav_hunk(dir)
-    if vim.wo.diff then
-        local map = {
-            prev = "[c",
-            next = "]c",
-        }
-        vim.cmd.normal({ map[dir], bang = true })
-    else
-        gitsigns.nav_hunk(dir)
-    end
-end
-
 gitsigns.setup({
    current_line_blame_opts = {
        -- Show the blame quickly
        delay = 100,
    },
-    -- Work-around for https://github.com/lewis6991/gitsigns.nvim/issues/929
-    signs_staged_enable = false,
 })

 local keys = {
    -- Navigation
-    { "[c", utils.partial(nav_hunk, "prev"), desc = "Previous hunk/diff" },
-    { "]c", utils.partial(nav_hunk, "next"), desc = "Next hunk/diff" },
+    ["[c"] = { "&diff ? '[c' : '<cmd>Gitsigns prev_hunk<CR>'", "Previous hunk/diff", expr = true },
+    ["]c"] = { "&diff ? ']c' : '<cmd>Gitsigns next_hunk<CR>'", "Next hunk/diff", expr = true },
+
    -- Commands
-    { "<leader>g", group = "Git" },
-    { "<leader>gb", gitsigns.toggle_current_line_blame, desc = "Toggle blame virtual text" },
-    { "<leader>gd", gitsigns.diffthis, desc = "Diff buffer" },
-    { "<leader>gD", utils.partial(gitsigns.diffthis, "~"), desc = "Diff buffer against last commit" },
-    { "<leader>gg", "<cmd>Git<CR>", desc = "Git status" },
-    { "<leader>gh", gitsigns.toggle_deleted, desc = "Show deleted hunks" },
-    { "<leader>gL", "<cmd>:sp<CR><C-w>T:Gllog --follow -- %:p<CR>", desc = "Current buffer log" },
-    { "<leader>gm", "<Plug>(git-messenger)", desc = "Current line blame" },
-    { "<leader>gp", gitsigns.preview_hunk, desc = "Preview hunk" },
-    { "<leader>gr", gitsigns.reset_hunk, desc = "Restore hunk" },
-    { "<leader>gR", gitsigns.reset_buffer, desc = "Restore buffer" },
-    { "<leader>gs", gitsigns.stage_hunk, desc = "Stage hunk" },
-    { "<leader>gS", gitsigns.stage_buffer, desc = "Stage buffer" },
-    { "<leader>gu", gitsigns.undo_stage_hunk, desc = "Undo stage hunk" },
-    { "<leader>g[", utils.partial(gitsigns.nav_hunk, "prev"), desc = "Previous hunk" },
-    { "<leader>g]", utils.partial(gitsigns.nav_hunk, "next"), desc = "Next hunk" },
+    ["<leader>g"] = {
+        name = "Git",
+        -- Actions
+        b = { gitsigns.toggle_current_line_blame, "Toggle blame virtual text" },
+        d = { gitsigns.diffthis, "Diff buffer" },
+        -- stylua: ignore
+        D = { function() gitsigns.diffthis("~") end, "Diff buffer against last commit" },
+        g = { "<cmd>Git<CR>", "Git status" },
+        h = { gitsigns.toggle_deleted, "Show deleted hunks" },
+        L = { "<cmd>:sp<CR><C-w>T:Gllog --follow -- %:p<CR>", "Current buffer log" },
+        m = { "<Plug>(git-messenger)", "Current line blame" },
+        p = { gitsigns.preview_hunk, "Preview hunk" },
+        r = { gitsigns.reset_hunk, "Restore hunk" },
+        R = { gitsigns.reset_buffer, "Restore buffer" },
+        s = { gitsigns.stage_hunk, "Stage hunk" },
+        S = { gitsigns.stage_buffer, "Stage buffer" },
+        u = { gitsigns.undo_stage_hunk, "Undo stage hunk" },
+        ["["] = { gitsigns.prev_hunk, "Previous hunk" },
+        ["]"] = { gitsigns.next_hunk, "Next hunk" },
+    },
 }

 local objects = {
-    mode = "o",
-    { "ih", gitsigns.select_hunk, desc = "Git hunk" },
-}
-- Visual
-local visual = {
-    mode = { "x" },
-    { "ih", gitsigns.select_hunk, desc = "Git hunk" },
-    { "<leader>g", group = "Git" },
-    { "<leader>gp", gitsigns.preview_hunk, desc = "Preview selection" },
-    { "<leader>gr", make_visual(gitsigns.reset_hunk), desc = "Restore selection" },
-    { "<leader>gs", make_visual(gitsigns.stage_hunk), desc = "Stage selection" },
-    { "<leader>gu", gitsigns.undo_stage_hunk, desc = "Undo stage selection" },
+    ["ih"] = { gitsigns.select_hunk, "Git hunk" },
 }

-wk.add(keys)
-wk.add(objects)
-wk.add(visual)
+local visual = {
+    ["ih"] = { gitsigns.select_hunk, "Git hunk" },
+
+    -- Only the actual command can make use of the visual selection...
+    ["<leader>g"] = {
+        name = "Git",
+        p = { ":Gitsigns preview_hunk<CR>", "Preview selection" },
+        r = { ":Gitsigns reset_hunk<CR>", "Restore selection" },
+        s = { ":Gitsigns stage_hunk<CR>", "Stage selection" },
+        u = { ":Gitsigns undo_stage_hunk<CR>", "Undo stage selection" },
+    },
+}
+
+wk.register(keys, { buffer = bufnr })
+wk.register(objects, { buffer = bufnr, mode = "o" })
+wk.register(visual, { buffer = bufnr, mode = "x" })
--- a/modules/home/vim/plugin/settings/lspconfig.lua
+++ b/modules/home/vim/plugin/settings/lspconfig.lua
@ -53,8 +53,8 @@ if utils.is_executable("pyright") then
    })
 end

-if utils.is_executable("ruff") then
-    lspconfig.ruff.setup({
+if utils.is_executable("ruff-lsp") then
+    lspconfig.ruff_lsp.setup({
        capabilities = capabilities,
        on_attach = lsp.on_attach,
    })
@ -74,31 +74,5 @@ if utils.is_executable("bash-language-server") then
        filetypes = { "bash", "sh", "zsh" },
        capabilities = capabilities,
        on_attach = lsp.on_attach,
-        settings = {
-            bashIde = {
-                shfmt = {
-                    -- Simplify the code
-                    simplifyCode = true,
-                    -- Indent switch cases
-                    caseIndent = true,
-                },
-            },
-        },
-    })
-end
-
-- Starlark
-if utils.is_executable("starpls") then
-    lspconfig.starpls.setup({
-        capabilities = capabilities,
-        on_attach = lsp.on_attach,
-    })
-end
-
-- Generic
-if utils.is_executable("typos-lsp") then
-    lspconfig.typos_lsp.setup({
-        capabilities = capabilities,
-        on_attach = lsp.on_attach,
    })
 end
--- a/modules/home/vim/plugin/settings/null-ls.lua
+++ b/modules/home/vim/plugin/settings/null-ls.lua
@ -18,6 +18,16 @@ null_ls.register({
    }),
 })

+-- C, C++
+null_ls.register({
+    null_ls.builtins.formatting.clang_format.with({
+        -- Only used if available, but prefer clangd formatting if available
+        condition = function()
+            return utils.is_executable("clang-format") and not utils.is_executable("clangd")
+        end,
+    }),
+})
+
 -- Nix
 null_ls.register({
    null_ls.builtins.formatting.nixpkgs_fmt.with({
@ -46,3 +56,29 @@ null_ls.register({
        condition = utils.is_executable_condition("isort"),
    }),
 })
+
+-- Shell (non-POSIX)
+null_ls.register({
+    null_ls.builtins.formatting.shfmt.with({
+        -- Indent with 4 spaces, simplify the code, indent switch cases,
+        -- add space after redirection, use bash dialect
+        extra_args = { "-i", "4", "-s", "-ci", "-sr", "-ln", "bash" },
+        -- Restrict to bash and zsh
+        filetypes = { "bash", "zsh" },
+        -- Only used if available
+        condition = utils.is_executable_condition("shfmt"),
+    }),
+})
+
+-- Shell (POSIX)
+null_ls.register({
+    null_ls.builtins.formatting.shfmt.with({
+        -- Indent with 4 spaces, simplify the code, indent switch cases,
+        -- add space after redirection, use POSIX
+        extra_args = { "-i", "4", "-s", "-ci", "-sr", "-ln", "posix" },
+        -- Restrict to POSIX sh
+        filetypes = { "sh" },
+        -- Only used if available
+        condition = utils.is_executable_condition("shfmt"),
+    }),
+})
--- a/modules/home/vim/plugin/settings/oil.lua
+++ b/modules/home/vim/plugin/settings/oil.lua
@ -1,34 +0,0 @@
-local oil = require("oil")
-local wk = require("which-key")
-
-local detail = false
-
-oil.setup({
-    view_options = {
-        -- Show files and directories that start with "." by default
-        show_hidden = true,
-        -- But never '..'
-        is_always_hidden = function(name, bufnr)
-            return name == ".."
-        end,
-    },
-    keymaps = {
-        ["gd"] = {
-            desc = "Toggle file detail view",
-            callback = function()
-                detail = not detail
-                if detail then
-                    oil.set_columns({ "icon", "permissions", "size", "mtime" })
-                else
-                    oil.set_columns({ "icon" })
-                end
-            end,
-        },
-    },
-})
-
-local keys = {
-    { "-", oil.open, desc = "Open parent directory" },
-}
-
-wk.add(keys)
--- a/modules/home/vim/plugin/settings/ssh.lua
+++ b/modules/home/vim/plugin/settings/ssh.lua
@ -0,0 +1,17 @@
+if not require("ambroisie.utils").is_ssh() then
+    return
+end
+
+local function copy(lines, _)
+    require("osc52").copy(table.concat(lines, "\n"))
+end
+
+local function paste()
+    return { vim.fn.split(vim.fn.getreg(""), "\n"), vim.fn.getregtype("") }
+end
+
+vim.g.clipboard = {
+    name = "osc52",
+    copy = { ["+"] = copy, ["*"] = copy },
+    paste = { ["+"] = paste, ["*"] = paste },
+}
--- a/modules/home/vim/plugin/settings/telescope.lua
+++ b/modules/home/vim/plugin/settings/telescope.lua
@ -1,6 +1,4 @@
 local telescope = require("telescope")
-local telescope_builtin = require("telescope.builtin")
-local wk = require("which-key")

 telescope.setup({
    defaults = {
@ -24,14 +22,3 @@ telescope.setup({

 telescope.load_extension("fzf")
 telescope.load_extension("lsp_handlers")
-
-local keys = {
-    { "<leader>f", group = "Fuzzy finder" },
-    { "<leader>fb", telescope_builtin.buffers, desc = "Open buffers" },
-    { "<leader>ff", telescope_builtin.git_files, desc = "Git tracked files" },
-    { "<leader>fF", telescope_builtin.find_files, desc = "Files" },
-    { "<leader>fg", telescope_builtin.live_grep, desc = "Grep string" },
-    { "<leader>fG", telescope_builtin.grep_string, desc = "Grep string under cursor" },
-}
-
-wk.add(keys)
--- a/modules/home/vim/plugin/settings/tree-sitter.lua
+++ b/modules/home/vim/plugin/settings/tree-sitter.lua
@ -1,5 +1,4 @@
 local ts_config = require("nvim-treesitter.configs")
-
 ts_config.setup({
    highlight = {
        enable = true,
@ -15,16 +14,16 @@ ts_config.setup({
            -- Jump to matching text objects
            lookahead = true,
            keymaps = {
-                ["aa"] = { query = "@parameter.outer", desc = "a parameter" },
-                ["ia"] = { query = "@parameter.inner", desc = "inner parameter" },
-                ["ab"] = { query = "@block.outer", desc = "a block" },
-                ["ib"] = { query = "@block.inner", desc = "inner block" },
-                ["ac"] = { query = "@class.outer", desc = "a class" },
-                ["ic"] = { query = "@class.inner", desc = "inner class" },
-                ["af"] = { query = "@function.outer", desc = "a function" },
-                ["if"] = { query = "@function.inner", desc = "inner function" },
-                ["ak"] = { query = "@comment.outer", desc = "a comment" },
-                ["aS"] = { query = "@statement.outer", desc = "a statement" },
+                ["aa"] = "@parameter.outer",
+                ["ia"] = "@parameter.inner",
+                ["ab"] = "@block.outer",
+                ["ib"] = "@block.inner",
+                ["ac"] = "@class.outer",
+                ["ic"] = "@class.inner",
+                ["af"] = "@function.outer",
+                ["if"] = "@function.inner",
+                ["ak"] = "@comment.outer",
+                ["aS"] = "@statement.outer",
            },
        },
        move = {
@ -32,22 +31,22 @@ ts_config.setup({
            -- Add to jump list
            set_jumps = true,
            goto_next_start = {
-                ["]m"] = { query = "@function.outer", desc = "Next method start" },
-                ["]S"] = { query = "@statement.outer", desc = "Next statement start" },
-                ["]]"] = { query = "@class.outer", desc = "Next class start" },
+                ["]m"] = "@function.outer",
+                ["]S"] = "@statement.outer",
+                ["]]"] = "@class.outer",
            },
            goto_next_end = {
-                ["]M"] = { query = "@function.outer", desc = "Next method end" },
-                ["]["] = { query = "@class.outer", desc = "Next class end" },
+                ["]M"] = "@function.outer",
+                ["]["] = "@class.outer",
            },
            goto_previous_start = {
-                ["[m"] = { query = "@function.outer", desc = "Previous method start" },
-                ["[S"] = { query = "@statement.outer", desc = "Previous statement start" },
-                ["[["] = { query = "@class.outer", desc = "Previous class start" },
+                ["[m"] = "@function.outer",
+                ["[S"] = "@statement.outer",
+                ["[["] = "@class.outer",
            },
            goto_previous_end = {
-                ["[M"] = { query = "@function.outer", desc = "Previous method end" },
-                ["[]"] = { query = "@class.outer", desc = "Previous class end" },
+                ["[M"] = "@function.outer",
+                ["[]"] = "@class.outer",
            },
        },
    },
--- a/modules/home/vim/plugin/settings/which-key.lua
+++ b/modules/home/vim/plugin/settings/which-key.lua
@ -1,33 +1,2 @@
 local wk = require("which-key")
-wk.setup({
-    icons = {
-        -- I don't like icons
-        mappings = false,
-        breadcrumb = "»",
-        separator = "➜",
-        group = "+",
-        ellipsis = "…",
-        keys = {
-            Up = " ",
-            Down = " ",
-            Left = " ",
-            Right = " ",
-            C = "<C>",
-            M = "<M>",
-            D = "<D>",
-            S = "<S>",
-            CR = "<CR>",
-            Esc = "<Esc> ",
-            NL = "<NL>",
-            BS = "<BS>",
-            Space = "<space>",
-            Tab = "<Tab> ",
-        },
-    },
-})
-
-local keys = {
-    { "<leader><leader>", vim.cmd.nohlsearch, desc = "Clear search highlight" },
-}
-
-wk.add(keys)
+wk.setup()
--- a/modules/home/vim/plugin/signtoggle.lua
+++ b/modules/home/vim/plugin/signtoggle.lua
@ -4,23 +4,17 @@ local signtoggle = vim.api.nvim_create_augroup("signtoggle", { clear = true })
 vim.api.nvim_create_autocmd({ "BufEnter", "FocusGained", "WinEnter" }, {
    pattern = "*",
    group = signtoggle,
-    callback = function()
-        vim.opt.signcolumn = "yes"
-    end,
+    command = "setlocal signcolumn=yes",
 })
 vim.api.nvim_create_autocmd({ "BufLeave", "FocusLost", "WinLeave" }, {
    pattern = "*",
    group = signtoggle,
-    callback = function()
-        vim.opt.signcolumn = "no"
-    end,
+    command = "setlocal signcolumn=yes",
 })

 -- Never show the sign column in a terminal buffer
 vim.api.nvim_create_autocmd({ "TermOpen" }, {
    pattern = "*",
    group = signtoggle,
-    callback = function()
-        vim.opt.signcolumn = "no"
-    end,
+    command = "setlocal signcolumn=no",
 })
--- a/modules/home/wget/default.nix
+++ b/modules/home/wget/default.nix
@ -20,7 +20,7 @@ in
    };

    xdg.configFile."wgetrc".text = ''
-      hsts-file = ${config.xdg.stateHome}/wget-hsts
+      hsts-file = ${config.xdg.dataHome}/wget-hsts
    '';
  };
 }
--- a/modules/home/wm/default.nix
+++ b/modules/home/wm/default.nix
@ -58,7 +58,7 @@ in
              service = "some-service-name";
            }
          ];
-          description = "list of block configurations, merged with the defaults";
+          description = "list of block configurations, merged with the defauls";
        };
      };
    };
--- a/modules/home/wm/i3/default.nix
+++ b/modules/home/wm/i3/default.nix
@ -127,10 +127,9 @@ in
            { class = "^Blueman-.*$"; }
            { title = "^htop$"; }
            { class = "^Thunderbird$"; instance = "Mailnews"; window_role = "filterlist"; }
-            { class = "^pavucontrol.*$"; }
+            { class = "^Pavucontrol.*$"; }
            { class = "^Arandr$"; }
-            { class = "^\\.blueman-manager-wrapped$"; }
-            { class = "^\\.arandr-wrapped$"; }
+            { class = ".?blueman-manager.*$"; }
          ];
        };

@ -372,7 +371,8 @@ in
          };

        startup = [
-          # NOTE: rely on systemd user services instead...
+          # FIXME
+          # { commdand; always; notification; }
        ];

        window = {
--- a/modules/home/wm/screen-lock/default.nix
+++ b/modules/home/wm/screen-lock/default.nix
@ -2,7 +2,7 @@
 let
  cfg = config.my.home.wm.screen-lock;

-  notificationCmd =
+  notficationCmd =
    let
      duration = toString (cfg.notify.delay * 1000);
      notifyCmd = "${lib.getExe pkgs.libnotify} -u critical -t ${duration}";
@ -48,7 +48,7 @@ in
          "-notify"
          "${toString cfg.notify.delay}"
          "-notifier"
-          notificationCmd
+          notficationCmd
        ];
      };
    };
--- a/modules/home/xdg/default.nix
+++ b/modules/home/xdg/default.nix
@ -11,7 +11,7 @@ in
    enable = true;
    # File types
    mime.enable = true;
-    # File associations
+    # File associatons
    mimeApps = {
      enable = true;
    };
@ -30,11 +30,9 @@ in
    };
    # A tidy home is a tidy mind
    dataFile = {
-      "tig/.keep".text = ""; # `tig` uses `XDG_DATA_HOME` specifically...
-    };
-    stateFile = {
      "bash/.keep".text = "";
-      "python/.keep".text = "";
+      "gdb/.keep".text = "";
+      "tig/.keep".text = "";
    };
  };

@ -45,13 +43,13 @@ in
    CARGO_HOME = "${dataHome}/cargo";
    DOCKER_CONFIG = "${configHome}/docker";
    GRADLE_USER_HOME = "${dataHome}/gradle";
-    HISTFILE = "${stateHome}/bash/history";
+    HISTFILE = "${dataHome}/bash/history";
    INPUTRC = "${configHome}/readline/inputrc";
-    PSQL_HISTORY = "${stateHome}/psql_history";
+    PSQL_HISTORY = "${dataHome}/psql_history";
    PYTHONPYCACHEPREFIX = "${cacheHome}/python/";
    PYTHONUSERBASE = "${dataHome}/python/";
    PYTHON_HISTORY = "${stateHome}/python/history";
-    REDISCLI_HISTFILE = "${stateHome}/redis/rediscli_history";
+    REDISCLI_HISTFILE = "${dataHome}/redis/rediscli_history";
    REPO_CONFIG_DIR = "${configHome}/repo";
    XCOMPOSECACHE = "${dataHome}/X11/xcompose";
    _JAVA_OPTIONS = "-Djava.util.prefs.userRoot=${configHome}/java";
--- a/modules/home/zsh/default.nix
+++ b/modules/home/zsh/default.nix
@ -68,7 +68,7 @@ in
          ignoreSpace = true;
          ignoreDups = true;
          share = false;
-          path = "${config.xdg.stateHome}/zsh/zsh_history";
+          path = "${config.xdg.dataHome}/zsh/zsh_history";
        };

        plugins = [
--- a/modules/home/zsh/options.zsh
+++ b/modules/home/zsh/options.zsh
@ -12,7 +12,7 @@ setopt rc_quotes
 setopt auto_resume
 # Show history expansion before running a command
 setopt hist_verify
-# Append commands to history as they are executed
+# Append commands to history as they are exectuted
 setopt inc_append_history_time
 # Remove useless whitespace from commands
 setopt hist_reduce_blanks
--- a/modules/nixos/hardware/bluetooth/default.nix
+++ b/modules/nixos/hardware/bluetooth/default.nix
@ -24,6 +24,24 @@ in
        extraModules = [ pkgs.pulseaudio-modules-bt ];
        package = pkgs.pulseaudioFull;
      };
+
+      services.pipewire.wireplumber.configPackages = [
+        (pkgs.writeTextDir "share/wireplumber/bluetooth.lua.d/51-bluez-config.lua" ''
+          bluez_monitor.properties = {
+            -- SBC XQ provides better audio
+            ["bluez5.enable-sbc-xq"] = true,
+
+            -- mSBC provides better audio + microphone
+            ["bluez5.enable-msbc"] = true,
+
+            -- Synchronize volume with bluetooth device
+            ["bluez5.enable-hw-volume"] = true,
+
+            -- FIXME: Some devices may now support both hsp_ag and hfp_ag
+            ["bluez5.headset-roles"] = "[ hsp_hs hsp_ag hfp_hf hfp_ag ]"
+          }
+        '')
+      ];
    })

    # Support for A2DP audio profile
--- a/modules/nixos/hardware/graphics/default.nix
+++ b/modules/nixos/hardware/graphics/default.nix
@ -26,30 +26,28 @@ in

  config = lib.mkIf cfg.enable (lib.mkMerge [
    {
-      hardware.graphics = {
+      hardware.opengl = {
        enable = true;
      };
    }

    # AMD GPU
    (lib.mkIf (cfg.gpuFlavor == "amd") {
-      hardware.amdgpu = {
-        initrd.enable = cfg.amd.enableKernelModule;
-        # Vulkan
-        amdvlk = lib.mkIf cfg.amd.amdvlk {
-          enable = true;
-          support32Bit = {
-            enable = true;
-          };
-        };
-      };
+      boot.initrd.kernelModules = lib.mkIf cfg.amd.enableKernelModule [ "amdgpu" ];

-      hardware.graphics = {
+      hardware.opengl = {
        extraPackages = with pkgs; [
          # OpenCL
          rocmPackages.clr
          rocmPackages.clr.icd
-        ];
+        ]
+        ++ lib.optional cfg.amd.amdvlk amdvlk
+        ;
+
+        extraPackages32 = with pkgs; [
+        ]
+        ++ lib.optional cfg.amd.amdvlk driversi686Linux.amdvlk
+        ;
      };
    })

@ -61,7 +59,7 @@ in
        VDPAU_DRIVER = "va_gl";
      };

-      hardware.graphics = {
+      hardware.opengl = {
        extraPackages = with pkgs; [
          # Open CL
          intel-compute-runtime
@ -71,13 +69,6 @@ in
          intel-vaapi-driver
          libvdpau-va-gl
        ];
-
-        extraPackages32 = with pkgs.driversi686Linux; [
-          # VA API
-          intel-media-driver
-          intel-vaapi-driver
-          libvdpau-va-gl
-        ];
      };
    })
  ]);
--- a/modules/nixos/hardware/sound/default.nix
+++ b/modules/nixos/hardware/sound/default.nix
@ -54,6 +54,9 @@ in

    # Pulseaudio setup
    (lib.mkIf cfg.pulse.enable {
+      # ALSA
+      sound.enable = true;
+
      hardware.pulseaudio.enable = true;
    })
  ]);
--- a/modules/nixos/hardware/trackball/default.nix
+++ b/modules/nixos/hardware/trackball/default.nix
@ -11,7 +11,7 @@ in
  config = lib.mkIf cfg.enable {
    services.xserver = {
      # This section must be *after* the one configured by `libinput`
-      # for the `ScrollMethod` configuration to not be overridden
+      # for the `ScrollMethod` configuration to not be overriden
      inputClassSections = lib.mkAfter [
        # MX Ergo
        ''
--- a/modules/nixos/profiles/default.nix
+++ b/modules/nixos/profiles/default.nix
@ -1,4 +1,4 @@
-# Configuration that spans across system and home, or are almagations of modules
+# Configuration that spans accross system and home, or are almagations of modules
 { ... }:
 {
  imports = [
--- a/modules/nixos/services/aria/default.nix
+++ b/modules/nixos/services/aria/default.nix
@ -65,7 +65,9 @@ in
      aria-rpc = {
        port = cfg.rpcPort;
        # Proxy websockets for RPC
-        websocketsLocations = [ "/" ];
+        extraConfig = {
+          locations."/".proxyWebsockets = true;
+        };
      };
    };

--- a/modules/nixos/services/audiobookshelf/default.nix
+++ b/modules/nixos/services/audiobookshelf/default.nix
@ -30,24 +30,10 @@ in
      audiobookshelf = {
        inherit (cfg) port;
        # Proxy websockets for RPC
-        websocketsLocations = [ "/" ];
+        extraConfig = {
+          locations."/".proxyWebsockets = true;
+        };
      };
    };
-
-    services.fail2ban.jails = {
-      audiobookshelf = ''
-        enabled = true
-        filter = audiobookshelf
-        port = http,https
-      '';
-    };
-
-    environment.etc = {
-      "fail2ban/filter.d/audiobookshelf.conf".text = ''
-        [Definition]
-        failregex = ^.*ERROR: \[Auth\] Failed login attempt for username ".*" from ip <ADDR>
-        journalmatch = _SYSTEMD_UNIT=audiobookshelf.service
-      '';
-    };
  };
 }
--- a/modules/nixos/services/default.nix
+++ b/modules/nixos/services/default.nix
@ -16,7 +16,6 @@
    ./grocy
    ./indexers
    ./jellyfin
-    ./komga
    ./lohr
    ./matrix
    ./mealie
@ -27,7 +26,7 @@
    ./nginx
    ./nix-cache
    ./paperless
-    ./pdf-edit
+    ./pirate
    ./podgrab
    ./postgresql
    ./postgresql-backup
@ -35,7 +34,6 @@
    ./quassel
    ./rss-bridge
    ./sabnzbd
-    ./servarr
    ./ssh-server
    ./tandoor-recipes
    ./tlp
--- a/modules/nixos/services/flood/default.nix
+++ b/modules/nixos/services/flood/default.nix
@ -1,5 +1,5 @@
 # A nice UI for various torrent clients
-{ config, lib, ... }:
+{ config, lib, pkgs, ... }:
 let
  cfg = config.my.services.flood;
 in
@ -13,13 +13,31 @@ in
      example = 3000;
      description = "Internal port for Flood UI";
    };
+
+    stateDir = mkOption {
+      type = types.str;
+      default = "flood";
+      example = "floodUI";
+      description = "Directory under `/var/run` for storing Flood's files";
+    };
  };

  config = lib.mkIf cfg.enable {
-    services.flood = {
-      enable = true;
+    systemd.services.flood = {
+      description = "Flood torrent UI";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];

-      inherit (cfg) port;
+      serviceConfig = {
+        ExecStart = lib.concatStringsSep " " [
+          (lib.getExe pkgs.flood)
+          "--port ${builtins.toString cfg.port}"
+          "--rundir /var/lib/${cfg.stateDir}"
+        ];
+        DynamicUser = true;
+        StateDirectory = cfg.stateDir;
+        ReadWritePaths = "";
+      };
    };

    my.services.nginx.virtualHosts = {
@ -27,7 +45,5 @@ in
        inherit (cfg) port;
      };
    };
-
-    # NOTE: unfortunately flood does not log connection failures for fail2ban
  };
 }
--- a/modules/nixos/services/forgejo/default.nix
+++ b/modules/nixos/services/forgejo/default.nix
@ -1,4 +1,4 @@
-# A low-resource, full-featured git forge.
+# A low-ressource, full-featured git forge.
 { config, lib, ... }:
 let
  cfg = config.my.services.forgejo;
@ -83,11 +83,7 @@ in
        # I configure my backup system manually below.
        dump.enable = false;

-        secrets = {
-          mailer = lib.mkIf cfg.mail.enable {
-            PASSWD = cfg.mail.passwordFile;
-          };
-        };
+        mailerPasswordFile = lib.mkIf cfg.mail.enable cfg.mail.passwordFile;

        settings = {
          DEFAULT = {
--- a/modules/nixos/services/gitea/default.nix
+++ b/modules/nixos/services/gitea/default.nix
@ -1,4 +1,4 @@
-# A low-resource, full-featured git forge.
+# A low-ressource, full-featured git forge.
 { config, lib, ... }:
 let
  cfg = config.my.services.gitea;
--- a/modules/nixos/services/grocy/default.nix
+++ b/modules/nixos/services/grocy/default.nix
@ -36,7 +36,5 @@ in
      forceSSL = true;
      useACMEHost = config.networking.domain;
    };
-
-    # NOTE: unfortunately grocy does not log connection failures for fail2ban
  };
 }
--- a/modules/nixos/services/jellyfin/default.nix
+++ b/modules/nixos/services/jellyfin/default.nix
@ -27,31 +27,19 @@ in
    my.services.nginx.virtualHosts = {
      jellyfin = {
        port = 8096;
-        websocketsLocations = [ "/socket" ];
        extraConfig = {
          locations."/" = {
            extraConfig = ''
              proxy_buffering off;
            '';
          };
+          # Too bad for the repetition...
+          locations."/socket" = {
+            proxyPass = "http://127.0.0.1:8096/";
+            proxyWebsockets = true;
+          };
        };
      };
    };
-
-    services.fail2ban.jails = {
-      jellyfin = ''
-        enabled = true
-        filter = jellyfin
-        port = http,https
-      '';
-    };
-
-    environment.etc = {
-      "fail2ban/filter.d/jellyfin.conf".text = ''
-        [Definition]
-        failregex = ^.*Authentication request for .* has been denied \(IP: "?<ADDR>"?\)\.
-        journalmatch = _SYSTEMD_UNIT=jellyfin.service
-      '';
-    };
  };
 }
--- a/modules/nixos/services/komga/default.nix
+++ b/modules/nixos/services/komga/default.nix
@ -1,55 +0,0 @@
-# A Comics/Manga media server
-{ config, lib, ... }:
-let
-  cfg = config.my.services.komga;
-in
-{
-  options.my.services.komga = with lib; {
-    enable = mkEnableOption "Komga comics server";
-
-    port = mkOption {
-      type = types.port;
-      default = 4584;
-      example = 8080;
-      description = "Internal port for webui";
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.komga = {
-      enable = true;
-      inherit (cfg) port;
-
-      group = "media";
-    };
-
-    systemd.services.komga.environment = {
-      LOGGING_LEVEL_ORG_GOTSON_KOMGA = "DEBUG"; # Needed for fail2ban
-    };
-
-    # Set-up media group
-    users.groups.media = { };
-
-    my.services.nginx.virtualHosts = {
-      komga = {
-        inherit (cfg) port;
-      };
-    };
-
-    services.fail2ban.jails = {
-      komga = ''
-        enabled = true
-        filter = komga
-        port = http,https
-      '';
-    };
-
-    environment.etc = {
-      "fail2ban/filter.d/komga.conf".text = ''
-        [Definition]
-        failregex = ^.* ip=<HOST>,.*Bad credentials.*$
-        journalmatch = _SYSTEMD_UNIT=komga.service
-      '';
-    };
-  };
-}
--- a/modules/nixos/services/matrix/default.nix
+++ b/modules/nixos/services/matrix/default.nix
@ -26,6 +26,21 @@ in
      description = "Shared secret to register users";
    };

+    slidingSync = {
+      port = mkOption {
+        type = types.port;
+        default = 8009;
+        example = 8084;
+        description = "Port used by sliding sync server";
+      };
+
+      secretFile = mkOption {
+        type = types.str;
+        example = "/var/lib/matrix/sliding-sync-secret-file.env";
+        description = "Secret file which contains SYNCV3_SECRET definition";
+      };
+    };
+
    mailConfigFile = mkOption {
      type = types.str;
      example = "/var/lib/matrix/email-config.yaml";
@ -91,6 +106,17 @@ in
      ] ++ lib.optional (cfg.secretFile != null) cfg.secretFile;
    };

+    services.matrix-sliding-sync = {
+      enable = true;
+
+      settings = {
+        SYNCV3_SERVER = "https://${matrixDomain}";
+        SYNCV3_BINDADDR = "127.0.0.1:${toString cfg.slidingSync.port}";
+      };
+
+      environmentFile = cfg.slidingSync.secretFile;
+    };
+
    my.services.nginx.virtualHosts = {
      # Element Web app deployment
      chat = {
@ -104,6 +130,9 @@ in
              "m.identity_server" = {
                "base_url" = "https://vector.im";
              };
+              "org.matrix.msc3575.proxy" = {
+                "url" = "https://matrix-sync.${domain}";
+              };
            };
            showLabsSettings = true;
            defaultCountryCode = "FR"; # cocorico
@ -123,6 +152,10 @@ in
      matrix-client = {
        port = clientPort.private;
      };
+      # Sliding sync
+      matrix-sync = {
+        inherit (cfg.slidingSync) port;
+      };
    };

    # Those are too complicated to use my wrapper...
@ -145,6 +178,11 @@ in

            "/_matrix" = proxyToClientPort;
            "/_synapse/client" = proxyToClientPort;
+
+            # Sliding sync
+            "~ ^/(client/|_matrix/client/unstable/org.matrix.msc3575/sync)" = {
+              proxyPass = "http://${config.services.matrix-sliding-sync.settings.SYNCV3_BINDADDR}";
+            };
          };

        listen = [
@ -190,6 +228,7 @@ in
            client = {
              "m.homeserver" = { "base_url" = "https://${matrixDomain}"; };
              "m.identity_server" = { "base_url" = "https://vector.im"; };
+              "org.matrix.msc3575.proxy" = { "url" = "https://matrix-sync.${domain}"; };
            };
            # ACAO required to allow element-web on any URL to request this json file
          in
--- a/modules/nixos/services/mealie/default.nix
+++ b/modules/nixos/services/mealie/default.nix
@ -35,8 +35,12 @@ in

        # Use PostgreSQL
        DB_ENGINE = "postgres";
-        # Make it work with socket auth
-        POSTGRES_URL_OVERRIDE = "postgresql://mealie:@/mealie?host=/run/postgresql";
+        POSTGRES_USER = "mealie";
+        POSTGRES_PASSWORD = "";
+        POSTGRES_SERVER = "/run/postgresql";
+        # Pydantic and/or mealie doesn't handle the URI correctly, hijack it
+        # with query parameters...
+        POSTGRES_DB = "mealie?host=/run/postgresql&dbname=mealie";
      };
    };

@ -71,21 +75,5 @@ in
        };
      };
    };
-
-    services.fail2ban.jails = {
-      mealie = ''
-        enabled = true
-        filter = mealie
-        port = http,https
-      '';
-    };
-
-    environment.etc = {
-      "fail2ban/filter.d/mealie.conf".text = ''
-        [Definition]
-        failregex = ^.*ERROR.*Incorrect username or password from <HOST>
-        journalmatch = _SYSTEMD_UNIT=mealie.service
-      '';
-    };
  };
 }
--- a/modules/nixos/services/miniflux/default.nix
+++ b/modules/nixos/services/miniflux/default.nix
@ -48,21 +48,5 @@ in
        inherit (cfg) port;
      };
    };
-
-    services.fail2ban.jails = {
-      miniflux = ''
-        enabled = true
-        filter = miniflux
-        port = http,https
-      '';
-    };
-
-    environment.etc = {
-      "fail2ban/filter.d/miniflux.conf".text = ''
-        [Definition]
-        failregex = ^.*msg="[^"]*(Incorrect|Invalid) username or password[^"]*".*client_ip=<ADDR>
-        journalmatch = _SYSTEMD_UNIT=miniflux.service
-      '';
-    };
  };
 }
--- a/modules/nixos/services/navidrome/default.nix
+++ b/modules/nixos/services/navidrome/default.nix
@ -52,21 +52,5 @@ in
        inherit (cfg) port;
      };
    };
-
-    services.fail2ban.jails = {
-      navidrome = ''
-        enabled = true
-        filter = navidrome
-        port = http,https
-      '';
-    };
-
-    environment.etc = {
-      "fail2ban/filter.d/navidrome.conf".text = ''
-        [Definition]
-        failregex = ^.*msg="Unsuccessful login".*X-Real-Ip:\[<HOST>\]
-        journalmatch = _SYSTEMD_UNIT=navidrome.service
-      '';
-    };
  };
 }
--- a/modules/nixos/services/nextcloud/collabora.nix
+++ b/modules/nixos/services/nextcloud/collabora.nix
@ -1,50 +0,0 @@
-# Document editor with Nextcloud
-{ config, lib, ... }:
-let
-  cfg = config.my.services.nextcloud.collabora;
-in
-{
-  options.my.services.nextcloud.collabora = with lib; {
-    enable = mkEnableOption "Collabora integration";
-
-    port = mkOption {
-      type = types.port;
-      default = 9980;
-      example = 8080;
-      description = "Internal port for API";
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.collabora-online = {
-      enable = true;
-      inherit (cfg) port;
-
-      aliasGroups = [
-        {
-          host = "https://collabora.${config.networking.domain}";
-          # Allow using from nextcloud
-          aliases = [ "https://${config.services.nextcloud.hostName}" ];
-        }
-      ];
-
-      settings = {
-        # Rely on reverse proxy for SSL
-        ssl = {
-          enable = false;
-          termination = true;
-        };
-      };
-    };
-
-    my.services.nginx.virtualHosts = {
-      collabora = {
-        inherit (cfg) port;
-        websocketsLocations = [
-          "~ ^/cool/(.*)/ws$"
-          "^~ /cool/adminws"
-        ];
-      };
-    };
-  };
-}
--- a/modules/nixos/services/nextcloud/default.nix
+++ b/modules/nixos/services/nextcloud/default.nix
@ -4,10 +4,6 @@ let
  cfg = config.my.services.nextcloud;
 in
 {
-  imports = [
-    ./collabora.nix
-  ];
-
  options.my.services.nextcloud = with lib; {
    enable = mkEnableOption "Nextcloud";
    maxSize = mkOption {
@ -35,7 +31,7 @@ in
  config = lib.mkIf cfg.enable {
    services.nextcloud = {
      enable = true;
-      package = pkgs.nextcloud30;
+      package = pkgs.nextcloud29;
      hostName = "nextcloud.${config.networking.domain}";
      home = "/var/lib/nextcloud";
      maxUploadSize = cfg.maxSize;
@ -91,25 +87,5 @@ in
        "${config.services.nextcloud.home}/data/appdata_*/preview"
      ];
    };
-
-    services.fail2ban.jails = {
-      nextcloud = ''
-        enabled = true
-        filter = nextcloud
-        port = http,https
-      '';
-    };
-
-    environment.etc = {
-      "fail2ban/filter.d/nextcloud.conf".text = ''
-        [Definition]
-        _groupsre = (?:(?:,?\s*"\w+":(?:"[^"]+"|\w+))*)
-        datepattern = ,?\s*"time"\s*:\s*"%%Y-%%m-%%d[T ]%%H:%%M:%%S(%%z)?"
-        failregex = ^[^{]*\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Login failed:
-                    ^[^{]*\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Trusted domain error.
-                    ^[^{]*\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Two-factor challenge failed:
-        journalmatch = _SYSTEMD_UNIT=phpfpm-nextcloud.service
-      '';
-    };
  };
 }
--- a/modules/nixos/services/nginx/default.nix
+++ b/modules/nixos/services/nginx/default.nix
@ -17,16 +17,6 @@ let
        '';
      };

-      websocketsLocations = mkOption {
-        type = with types; listOf str;
-        default = [ ];
-        example = [ "/socket" ];
-        description = ''
-          Which locations on this virtual host should be configured for
-          websockets.
-        '';
-      };
-
      port = mkOption {
        type = with types; nullOr port;
        default = null;
@ -69,15 +59,14 @@ let

      extraConfig = mkOption {
        type = types.attrs; # FIXME: forward type of virtualHosts
-        example = {
-          extraConfig = ''
-            add_header X-Clacks-Overhead "GNU Terry Pratchett";
-          '';
-
-          locations."/".extraConfig = ''
-            client_max_body_size 1G;
-          '';
-        };
+        example = litteralExample ''
+          {
+            locations."/socket" = {
+              proxyPass = "http://127.0.0.1:8096/";
+              proxyWebsockets = true;
+            };
+          }
+        '';
        default = { };
        description = ''
          Any extra configuration that should be applied to this virtual host.
@ -99,7 +88,7 @@ in
        type = types.str;
        example = "/var/lib/acme/creds.env";
        description = ''
-          OVH API key file as an 'EnvironmentFile' (see `systemd.exec(5)`)
+          Gandi API key file as an 'EnvironmentFile' (see `systemd.exec(5)`)
        '';
      };
    };
@ -111,19 +100,26 @@ in
    virtualHosts = mkOption {
      type = types.attrsOf virtualHostOption;
      default = { };
-      example = {
-        gitea = {
-          subdomain = "git";
-          port = 8080;
-        };
-        dev = {
-          root = "/var/www/dev";
-        };
-        jellyfin = {
-          port = 8096;
-          websocketsLocations = [ "/socket" ];
-        };
-      };
+      example = litteralExample ''
+        {
+          gitea = {
+            subdomain = "git";
+            port = 8080;
+          };
+          dev = {
+            root = "/var/www/dev";
+          };
+          jellyfin = {
+            port = 8096;
+            extraConfig = {
+              locations."/socket" = {
+                proxyPass = "http://127.0.0.1:8096/";
+                proxyWebsockets = true;
+              };
+            };
+          };
+        }
+      '';
      description = ''
        List of virtual hosts to set-up using default settings.
      '';
@ -167,21 +163,25 @@ in
            };
          };
        });
-        example = {
-          alice = {
-            passwordHashFile = "/var/lib/nginx-sso/alice/password-hash.txt";
-            totpSecretFile = "/var/lib/nginx-sso/alice/totp-secret.txt";
-          };
-        };
+        example = litteralExample ''
+          {
+            alice = {
+              passwordHashFile = "/var/lib/nginx-sso/alice/password-hash.txt";
+              totpSecretFile = "/var/lib/nginx-sso/alice/totp-secret.txt";
+            };
+          }
+        '';
        description = "Definition of users";
      };

      groups = mkOption {
        type = with types; attrsOf (listOf str);
-        example = {
-          root = [ "alice" ];
-          users = [ "alice" "bob" ];
-        };
+        example = litteralExample ''
+          {
+            root = [ "alice" ];
+            users = [ "alice" "bob" ];
+          }
+        '';
        description = "Groups of users";
      };
    };
@ -203,19 +203,6 @@ in
          } configured.
        '';
      }))
-      ++ (lib.flip lib.mapAttrsToList cfg.virtualHosts (_: { subdomain, ... } @ args:
-      let
-        proxyPass = [ "port" "socket" ];
-        proxyPassUsed = lib.any (v: args.${v} != null) proxyPass;
-      in
-      {
-        assertion = args.websocketsLocations != [ ] -> proxyPassUsed;
-        message = ''
-          Subdomain '${subdomain}' can only use 'websocketsLocations' with one of ${
-            lib.concatStringsSep ", " (builtins.map (v: "'${v}'") proxyPass)
-          }.
-        '';
-      }))
      ++ (
      let
        ports = lib.my.mapFilter
@ -262,14 +249,6 @@ in
      virtualHosts =
        let
          domain = config.networking.domain;
-          mkProxyPass = { websocketsLocations, ... }: proxyPass:
-            let
-              websockets = lib.genAttrs websocketsLocations (_: {
-                inherit proxyPass;
-                proxyWebsockets = true;
-              });
-            in
-            { "/" = { inherit proxyPass; }; } // websockets;
          mkVHost = ({ subdomain, ... } @ args: lib.nameValuePair
            "${subdomain}.${domain}"
            (lib.my.recursiveMerge [
@ -280,7 +259,8 @@ in
              }
              # Proxy to port
              (lib.optionalAttrs (args.port != null) {
-                locations = mkProxyPass args "http://127.0.0.1:${toString args.port}";
+                locations."/".proxyPass =
+                  "http://127.0.0.1:${toString args.port}";
              })
              # Serve filesystem content
              (lib.optionalAttrs (args.root != null) {
@ -288,7 +268,8 @@ in
              })
              # Serve to UNIX socket
              (lib.optionalAttrs (args.socket != null) {
-                locations = mkProxyPass args "http://unix:${args.socket}";
+                locations."/".proxyPass =
+                  "http://unix:${args.socket}";
              })
              # Redirect to a different domain
              (lib.optionalAttrs (args.redirect != null) {
@ -308,7 +289,6 @@ in

                locations."/" = {
                  extraConfig =
-                    # FIXME: check that X-User is dropped otherwise
                    (args.extraConfig.locations."/".extraConfig or "") + ''
                      # Use SSO
                      auth_request /sso-auth;
@ -442,8 +422,7 @@ in
        {
          "${domain}" = {
            extraDomainNames = [ "*.${domain}" ];
-            dnsProvider = "ovh";
-            dnsPropagationCheck = false; # OVH is slow
+            dnsProvider = "gandiv5";
            inherit (cfg.acme) credentialsFile;
          };
        };
--- a/modules/nixos/services/nginx/sso/default.nix
+++ b/modules/nixos/services/nginx/sso/default.nix
@ -59,10 +59,15 @@ in
        StateDirectory = "nginx-sso";
        WorkingDirectory = "/var/lib/nginx-sso";
        # The files to be merged might not have the correct permissions
-        ExecStartPre = pkgs.writeShellScript "merge-nginx-sso-config" ''
+        ExecStartPre = ''+${pkgs.writeShellScript "merge-nginx-sso-config" ''
          rm -f '${confPath}'
          ${utils.genJqSecretsReplacementSnippet cfg.configuration confPath}
-        '';
+
+          # Fix permissions
+          chown nginx-sso:nginx-sso ${confPath}
+          chmod 0600 ${confPath}
+        ''
+        }'';
        ExecStart = lib.mkForce ''
          ${lib.getExe pkg} \
            --config ${confPath} \
--- a/modules/nixos/services/nix-cache/default.nix
+++ b/modules/nixos/services/nix-cache/default.nix
@ -40,7 +40,7 @@ in
        inherit (cfg) priority;
      };

-      signKeyPaths = [ cfg.secretKeyFile ];
+      signKeyPath = cfg.secretKeyFile;
    };

    my.services.nginx.virtualHosts = {
--- a/modules/nixos/services/paperless/default.nix
+++ b/modules/nixos/services/paperless/default.nix
@ -1,4 +1,4 @@
-{ config, lib, ... }:
+{ config, lib, pkgs, ... }:
 let
  cfg = config.my.services.paperless;
 in
@ -61,6 +61,11 @@ in
          PAPERLESS_ENABLE_HTTP_REMOTE_USER = true;
          PAPERLESS_HTTP_REMOTE_USER_HEADER_NAME = "HTTP_X_USER";

+          # Use PostgreSQL
+          PAPERLESS_DBHOST = "/run/postgresql";
+          PAPERLESS_DBUSER = "paperless";
+          PAPERLESS_DBNAME = "paperless";
+
          # Security settings
          PAPERLESS_ALLOWED_HOSTS = paperlessDomain;
          PAPERLESS_CORS_ALLOWED_HOSTS = "https://${paperlessDomain}";
@ -75,18 +80,63 @@ in
          # Misc
          PAPERLESS_TIME_ZONE = config.time.timeZone;
          PAPERLESS_ADMIN_USER = cfg.username;
+
+          # Fix classifier hangs
+          LD_LIBRARY_PATH = "${lib.getLib pkgs.mkl}/lib";
        };

      # Admin password
      passwordFile = cfg.passwordFile;
+    };

-      # Secret key
-      environmentFile = cfg.secretKeyFile;
+    systemd.services = {
+      paperless-scheduler = {
+        requires = [ "postgresql.service" ];
+        after = [ "postgresql.service" ];

-      # Automatic PostgreSQL provisioning
-      database = {
-        createLocally = true;
+        serviceConfig = {
+          EnvironmentFile = cfg.secretKeyFile;
+        };
      };
+
+      paperless-consumer = {
+        requires = [ "postgresql.service" ];
+        after = [ "postgresql.service" ];
+
+        serviceConfig = {
+          EnvironmentFile = cfg.secretKeyFile;
+        };
+      };
+
+      paperless-web = {
+        requires = [ "postgresql.service" ];
+        after = [ "postgresql.service" ];
+
+        serviceConfig = {
+          EnvironmentFile = cfg.secretKeyFile;
+        };
+      };
+
+      paperless-task-queue = {
+        requires = [ "postgresql.service" ];
+        after = [ "postgresql.service" ];
+
+        serviceConfig = {
+          EnvironmentFile = cfg.secretKeyFile;
+        };
+      };
+    };
+
+    # Set-up database
+    services.postgresql = {
+      enable = true;
+      ensureDatabases = [ "paperless" ];
+      ensureUsers = [
+        {
+          name = "paperless";
+          ensureDBOwnership = true;
+        }
+      ];
    };

    # Set-up media group
@ -102,7 +152,11 @@ in
        sso = {
          enable = true;
        };
-        websocketsLocations = [ "/" ];
+
+        # Enable websockets on root
+        extraConfig = {
+          locations."/".proxyWebsockets = true;
+        };
      };
    };

--- a/modules/nixos/services/pdf-edit/default.nix
+++ b/modules/nixos/services/pdf-edit/default.nix
@ -1,73 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.my.services.pdf-edit;
-in
-{
-  options.my.services.pdf-edit = with lib; {
-    enable = mkEnableOption "PDF edition service";
-
-    port = mkOption {
-      type = types.port;
-      default = 8089;
-      example = 8080;
-      description = "Internal port for webui";
-    };
-
-    loginFile = mkOption {
-      type = types.str;
-      example = "/run/secrets/pdf-edit/login.env";
-      description = ''
-        `SECURITY_INITIALLOGIN_USERNAME` and `SECURITY_INITIALLOGIN_PASSWORD`
-        defined in the format of 'EnvironmentFile' (see `systemd.exec(5)`).
-      '';
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.stirling-pdf = lib.mkIf cfg.enable {
-      enable = true;
-
-      environment = {
-        SERVER_PORT = cfg.port;
-        SECURITY_CSRFDISABLED = "false";
-
-        SYSTEM_SHOWUPDATE = "false"; # We don't care about update notifications
-        INSTALL_BOOK_AND_ADVANCED_HTML_OPS = "true"; # Installed by the module
-
-        SECURITY_ENABLELOGIN = "true";
-        SECURITY_LOGINATTEMPTCOUNT = "-1"; # Rely on fail2ban instead
-      };
-
-      environmentFiles = [ cfg.loginFile ];
-    };
-
-    my.services.nginx.virtualHosts = {
-      pdf-edit = {
-        inherit (cfg) port;
-
-        extraConfig = {
-          # Allow upload of PDF files up to 1G
-          locations."/".extraConfig = ''
-            client_max_body_size 1G;
-          '';
-        };
-      };
-    };
-
-    services.fail2ban.jails = {
-      stirling-pdf = ''
-        enabled = true
-        filter = stirling-pdf
-        port = http,https
-      '';
-    };
-
-    environment.etc = {
-      "fail2ban/filter.d/stirling-pdf.conf".text = ''
-        [Definition]
-        failregex = ^.*Failed login attempt from IP: <HOST>$
-        journalmatch = _SYSTEMD_UNIT=stirling-pdf.service
-      '';
-    };
-  };
-}
--- a/modules/nixos/services/servarr/default.nix
+++ b/modules/nixos/services/servarr/default.nix
@ -4,13 +4,12 @@
 # [1]: https://youtu.be/I26Ql-uX6AM
 { config, lib, ... }:
 let
-  cfg = config.my.services.servarr;
+  cfg = config.my.services.pirate;

  ports = {
    bazarr = 6767;
    lidarr = 8686;
    radarr = 7878;
-    readarr = 8787;
    sonarr = 8989;
  };

@ -53,7 +52,7 @@ let
  ]);
 in
 {
-  options.my.services.servarr = {
+  options.my.services.pirate = {
    enable = lib.mkEnableOption "Media automation";

    bazarr = {
@ -68,10 +67,6 @@ in
      enable = lib.my.mkDisableOption "Radarr";
    };

-    readarr = {
-      enable = lib.my.mkDisableOption "Readarr";
-    };
-
    sonarr = {
      enable = lib.my.mkDisableOption "Sonarr";
    };
@ -90,21 +85,8 @@ in
    # Radarr for movies
    (mkFullConfig "radarr")
    (mkFail2Ban "radarr")
-    # Readarr for books
-    (mkFullConfig "readarr")
-    (mkFail2Ban "readarr")
    # Sonarr for shows
    (mkFullConfig "sonarr")
    (mkFail2Ban "sonarr")
-
-    # HACK: until https://github.com/NixOS/nixpkgs/issues/360592 is resolved
-    (lib.mkIf cfg.sonarr.enable {
-      nixpkgs.config.permittedInsecurePackages = [
-        "aspnetcore-runtime-6.0.36"
-        "aspnetcore-runtime-wrapped-6.0.36"
-        "dotnet-sdk-6.0.428"
-        "dotnet-sdk-wrapped-6.0.428"
-      ];
-    })
  ]);
 }
--- a/modules/nixos/services/podgrab/default.nix
+++ b/modules/nixos/services/podgrab/default.nix
@ -13,7 +13,7 @@ in
      example = "/run/secrets/password.env";
      description = ''
        The path to a file containing the PASSWORD environment variable
-        definition for Podgrab's authentication.
+        definition for Podgrab's authentification.
      '';
    };

--- a/modules/nixos/services/postgresql/default.nix
+++ b/modules/nixos/services/postgresql/default.nix
@ -14,7 +14,7 @@ in
    # Let other services enable postgres when they need it
    (lib.mkIf cfg.enable {
      services.postgresql = {
-        package = pkgs.postgresql_17;
+        package = pkgs.postgresql_13;
      };
    })

@ -23,15 +23,15 @@ in
      environment.systemPackages =
        let
          pgCfg = config.services.postgresql;
-          newPackage' = pkgs.postgresql_17;
+          newPackage' = pkgs.postgresql_13;

          oldPackage = if pgCfg.enableJIT then pgCfg.package.withJIT else pgCfg.package;
          oldData = pgCfg.dataDir;
-          oldBin = "${if pgCfg.extensions == [] then oldPackage else oldPackage.withPackages pgCfg.extensions}/bin";
+          oldBin = "${if pgCfg.extraPlugins == [] then oldPackage else oldPackage.withPackages pgCfg.extraPlugins}/bin";

          newPackage = if pgCfg.enableJIT then newPackage'.withJIT else newPackage';
          newData = "/var/lib/postgresql/${newPackage.psqlSchema}";
-          newBin = "${if pgCfg.extensions == [] then newPackage else newPackage.withPackages pgCfg.extensions}/bin";
+          newBin = "${if pgCfg.extraPlugins == [] then newPackage else newPackage.withPackages pgCfg.extraPlugins}/bin";
        in
        [
          (pkgs.writeScriptBin "upgrade-pg-cluster" ''
--- a/modules/nixos/services/pyload/default.nix
+++ b/modules/nixos/services/pyload/default.nix
@ -53,20 +53,6 @@ in
      };
    };

-    services.fail2ban.jails = {
-      pyload = ''
-        enabled = true
-        filter = pyload
-        port = http,https
-      '';
-    };
-
-    environment.etc = {
-      "fail2ban/filter.d/pyload.conf".text = ''
-        [Definition]
-        failregex = ^.*Login failed for user '<F-USER>.*</F-USER>' \[CLIENT: <HOST>\]$
-        journalmatch = _SYSTEMD_UNIT=pyload.service
-      '';
-    };
+    # FIXME: fail2ban
  };
 }
--- a/modules/nixos/services/tandoor-recipes/default.nix
+++ b/modules/nixos/services/tandoor-recipes/default.nix
@ -82,7 +82,5 @@ in
        };
      };
    };
-
-    # NOTE: unfortunately tandoor-recipes does not log connection failures for fail2ban
  };
 }
--- a/modules/nixos/services/transmission/default.nix
+++ b/modules/nixos/services/transmission/default.nix
@ -90,7 +90,5 @@ in
      allowedTCPPorts = [ cfg.peerPort ];
      allowedUDPPorts = [ cfg.peerPort ];
    };
-
-    # NOTE: unfortunately transmission does not log connection failures for fail2ban
  };
 }
--- a/modules/nixos/services/vikunja/default.nix
+++ b/modules/nixos/services/vikunja/default.nix
@ -41,7 +41,7 @@ in
        service = {
          # Only allow registration of users through the CLI
          enableregistration = false;
-          # Use the host's timezone
+          # Ues the host's timezone
          timezone = config.time.timeZone;
          # Use UNIX socket for serving the API
          unixsocket = socketPath;
@ -99,7 +99,5 @@ in
        config.services.vikunja.settings.files.basepath
      ];
    };
-
-    # NOTE: unfortunately vikunja does not log connection failures for fail2ban
  };
 }
--- a/modules/nixos/services/wireguard/default.nix
+++ b/modules/nixos/services/wireguard/default.nix
@ -206,7 +206,7 @@ in
      ];
    }

-    # Additional interface is only used to get access to "LAN" from wireguard
+    # Additional inteface is only used to get access to "LAN" from wireguard
    (lib.mkIf cfg.internal.enable {
      networking.wg-quick.interfaces."${cfg.internal.name}" = mkInterface [
        "${cfg.net.v4.subnet}.0/${toString cfg.net.v4.mask}"
--- a/modules/nixos/system/nix/default.nix
+++ b/modules/nixos/system/nix/default.nix
@ -22,10 +22,6 @@ in
  options.my.system.nix = with lib; {
    enable = my.mkDisableOption "nix configuration";

-    gc = {
-      enable = my.mkDisableOption "nix GC configuration";
-    };
-
    cache = {
      selfHosted = my.mkDisableOption "self-hosted cache";
    };
@ -66,22 +62,6 @@ in
      };
    }

-    (lib.mkIf cfg.gc.enable {
-      nix.gc = {
-        automatic = true;
-
-        # Every week, with some wiggle room
-        dates = "weekly";
-        randomizedDelaySec = "10min";
-
-        # Use a persistent timer for e.g: laptops
-        persistent = true;
-
-        # Delete old profiles automatically after 15 days
-        options = "--delete-older-than 15d";
-      };
-    })
-
    (lib.mkIf cfg.cache.selfHosted {
      nix = {
        settings = {
--- a/modules/nixos/system/packages/default.nix
+++ b/modules/nixos/system/packages/default.nix
@ -1,5 +1,5 @@
 # Common packages
-{ config, lib, ... }:
+{ config, lib, pkgs, ... }:
 let
  cfg = config.my.system.packages;
 in
@ -13,11 +13,13 @@ in
  };

  config = lib.mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [
+      vim
+      wget
+    ];
+
    programs = {
-      vim = {
-        enable = true;
-        defaultEditor = true; # Modal editing is life
-      };
+      vim.defaultEditor = true; # Modal editing is life

      zsh = {
        enable = true; # Use integrations
--- a/overlays/downgrade-transmission/default.nix
+++ b/overlays/downgrade-transmission/default.nix
@ -1,14 +0,0 @@
-self: prev:
-{
-  transmission_4 = prev.transmission_4.overrideAttrs (_: {
-    version = "4.0.5";
-
-    src = self.fetchFromGitHub {
-      owner = "transmission";
-      repo = "transmission";
-      rev = "4.0.5";
-      hash = "sha256-gd1LGAhMuSyC/19wxkoE2mqVozjGPfupIPGojKY0Hn4=";
-      fetchSubmodules = true;
-    };
-  });
-}
--- a/overlays/lsp-format-nvim-indentation/default.nix
+++ b/overlays/lsp-format-nvim-indentation/default.nix
@ -1,4 +0,0 @@
-self: prev:
-{
-  vimPlugins = prev.vimPlugins.extend (self.callPackage ./generated.nix { });
-}
--- a/overlays/lsp-format-nvim-indentation/generated.nix
+++ b/overlays/lsp-format-nvim-indentation/generated.nix
@ -1,14 +0,0 @@
-{ fetchpatch, ... }:
-
-_final: prev: {
-  lsp-format-nvim = prev.lsp-format-nvim.overrideAttrs (oa: {
-    patches = (oa.patches or [ ]) ++ [
-      # https://github.com/lukas-reineke/lsp-format.nvim/issues/94
-      (fetchpatch {
-        name = "use-effective-indentation";
-        url = "https://github.com/liskin/lsp-format.nvim/commit/3757ac443bdf5bd166673833794553229ee8d939.patch";
-        hash = "sha256-Dv+TvXrU/IrrPxz2MSPbLmRxch+qkHbI3AyFMj/ssDk=";
-      })
-    ];
-  });
-}
--- a/pkgs/bw-pass/bw-pass
+++ b/pkgs/bw-pass/bw-pass
@ -66,7 +66,7 @@ query_password() {
    printf '%s\n' "$PASSWORD"
 }

-if [ $# -lt 1 ] || [ $# -gt 2 ]; then
+if [ $# -lt 1  ] || [ $# -gt 2 ]; then
    usage
    exit 1
 fi
--- a/pkgs/change-audio/change-audio
+++ b/pkgs/change-audio/change-audio
@ -62,7 +62,7 @@ do_toggle() {
 }

 case "$1" in
-    up | down)
+    up|down)
        do_change_volume "$@"
        ;;
    toggle)
--- a/pkgs/diff-flake/diff-flake
+++ b/pkgs/diff-flake/diff-flake
@ -81,23 +81,23 @@ parse_args() {
        shift

        case "$opt" in
-            -h | --help)
+            -h|--help)
                usage
                exit
                ;;
-            -f | --flake-output)
+            -f|--flake-output)
                FLAKE_OUTPUTS+=("$1")
                shift
                ;;
-            -o | --output)
+            -o|--output)
                OUTPUT_FILE="$1"
                shift
                ;;
-            -n | --new-rev)
+            -n|--new-rev)
                NEW_REV="$(git rev-parse "$1")"
                shift
                ;;
-            -p | --previous-rev)
+            -p|--previous-rev)
                PREVIOUS_REV="$(git rev-parse "$1")"
                shift
                ;;
@ -157,7 +157,7 @@ list_dev_shells() {
 }

 diff_output() {
-    local PREV NEW
+    local PREV NEW;
    PREV="$(mktemp --dry-run)"
    NEW="$(mktemp --dry-run)"

@ -169,7 +169,7 @@ diff_output() {
        printf 'Closure diff for `%s`:\n```\n' "$1"
        nix store diff-closures "$PREV" "$NEW" | sanitize_output
        printf '```\n\n'
-    } >>"$OUTPUT_FILE"
+    } >> "$OUTPUT_FILE"
 }

 parse_args "$@"
--- a/pkgs/lohr/default.nix
+++ b/pkgs/lohr/default.nix
@ -1,16 +1,16 @@
 { lib, fetchFromGitHub, rustPlatform }:
 rustPlatform.buildRustPackage rec {
  pname = "lohr";
-  version = "0.4.6";
+  version = "0.4.5";

  src = fetchFromGitHub {
    owner = "alarsyo";
    repo = "lohr";
    rev = "v${version}";
-    hash = "sha256-dunQgtap+XCK5LoSyOqIY/6p6HizBeiyPWNuCffwjDU=";
+    hash = "sha256-p6E/r+OxFTpxDpOKSlacOxvRLfHSKg1mHNAfTytfqDY=";
  };

-  cargoHash = "sha256-EUhyrhPe+mUgMmm4o+bxRIiSNReJRfw+/O1fPr8r7lo=";
+  cargoHash = "sha256-hext0S0o9D9pN9epzXtD5dwAYMPCLpBBOBT4FX0mTMk=";

  meta = with lib; {
    description = "Git mirroring daemon";
--- a/Show more
+++ b/Show more